What Happened

On October 15, 2026, identity company Proof launched x401, an open protocol that lets a website ask an AI agent whom it represents and what that person authorized. The release includes an agent identity wallet, the x401 HTTP protocol and a production MCP server.

The consumer approves a transaction with a biometric check on their own device. Any later change to the amount, recipient or other signed terms invalidates the signature, and merchants can use the signed record as evidence in a dispute. Proof designed x401 to work with x402, the payment protocol stewarded by the Linux Foundation, and will demonstrate it at Money20/20 in Las Vegas on October 18–21. x401 is brand new and has no adoption figures yet.

The timing matters. Bot-security firm DataDome reported that AI agent traffic reached nearly 25 billion requests in Q3 2026, up 41.5% from the previous quarter, and that Meta’s Muse browser sent 29.1 million requests without identifying itself as an AI agent. These are vendor figures, so treat them as directional.

Three Takeaways for Small Businesses

  • Expect agent visitors, and know which pages they touch. DataDome says 8.9% of sampled Muse requests hit form, login, payment or cart endpoints. If you sell online, check your analytics for unidentified automated traffic on those pages.
  • Keep a human approval step. Wix’s Symphony agents can pay suppliers and restock inventory, but the owner must approve each purchase by WhatsApp or SMS within 10 minutes. Lightspeed’s opt-in beta likewise requires a preview and explicit approval before an agent changes anything.
  • Keep records that prove who approved what. The value of x401 is a signed record that any change invalidates. Whatever tools you use, make sure you can show who authorized an order, for how much and to whom.
The Bottom Line

As agents start to browse and buy on people’s behalf, trust shifts from “is this a human?” to “who is this agent working for, and what did they approve?”

What To Do This Week

Open your analytics and list which automated visitors reach your checkout, login and contact forms. Then write down which actions in your own AI tools should always need a human yes, and make sure that approval is logged.