Meta wants a percent of the trip. It wants none of the blame.

A WhatsApp help page is two documents. One is for you. The other is for the assistant that answers you, and until October 18 you could read both if you knew where to look.

Dan Saltman, who runs an account-deletion service called Redact (so he has an interest, which he does not hide and I will not either), pulled 545 pages linked from WhatsApp's Help Centre and found hidden text in 80 of them, 102 blocks in all, labelled "Never shown on screen." Google's and Bing's crawlers were served the blocks with the page. Requests under the names of OpenAI's, Anthropic's and Perplexity's crawlers got neither the article nor the notes. The blocks were instructions for Meta's support assistant, and most of them were dull. Two were not, and both were written for the moment a user tries to leave.

On the page about deleting your account, for the case where you have lost the phone number: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." On the page about reporting and blocking, for the case where "a user mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation": "Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA)," and this "including when a user raises them directly." WhatsApp's own privacy policy tells you that you may lodge a complaint with a data-protection authority. The assistant was told not to mention that you could. WhatsApp, through WIRED, called it a bug, said it was fixed, and said it wants its support chatbots "not to offer legal advice." The Internet Archive has the note present on September 4 and absent on July 12, so the bug ran for at least six weeks, and all 102 blocks were gone by two in the morning UTC on October 18.

Saltman did not test whether the assistant obeyed. That is the honest limit of the finding, and it is also beside the point. Somebody wrote those lines, somebody reviewed the page they sat on, and the one place in the whole help centre where the assistant was told what not to say was the exit.

The same fortnight

Three days after the blocks came down, on October 21, Mark Zuckerberg took Meta's third-quarter call and talked about Muse, the agent Meta launched in September for billions of people. More than 10 million people in the United States and Canada had set one up in about six weeks. A quarter use it daily. More than a quarter of its weekly users shop with it, at an average purchase above $200. Meta had to ask Stripe to raise its credit limits because the volumes ran past "what any of us expected." Travel, he said, is one of Muse's "top use cases." And on how Meta gets paid: the company is weighing models under which "we get a percent of the value that we are helping to create for people."

Two days before that, on October 19, Meta had posted revised Commercial Terms for the businesses that advertise and sell across Facebook, Instagram, WhatsApp and Threads, with a new section on AI. "AI features may make mistakes and may not always produce accurate, complete, or suitable results," it says, and customers "are solely responsible for and assume any and all risks associated with such AI features and any resulting content." It was to take effect on October 30. After a week of advertisers asking what they had just agreed to, Meta moved the date to November 20, to give itself time to explain. The wording, as of the last check I have seen, had not changed.

So inside one fortnight, from one company: a percent of the value the agent creates, for the owner; any and all risk of the agent's mistakes, for the business using it; and an assistant that, when you try to leave, is briefed against your remedies. Each of the three was reported as its own story. A monetisation plan, a contract gotcha, a privacy bug. Put them on one page and they are one design.

What the commission was for

I spent much of my career in travel, which means I spent it inside the oldest version of this deal, and the travel agent's commission is the cleanest way I know to see what is new here.

A travel agent earned a percent of the booking. Ten percent, once, on an air ticket; more on a cruise, less on a hotel, and later a fee when the airlines cut the commission to nothing and the agencies had to say out loud what they had been selling all along. Nobody paid the agent for finding the flight. Finding the flight was never hard. The percent paid for what happened after the finding: the agent had issued the ticket on an airline's own plate, under an accreditation that made the agency answerable for it, and when the connection was missed at two in the morning in Frankfurt, the agent was the one who picked up the phone. The commission was a price for accountability with a search service attached. When the search got free, the accountability was what was left to charge for, and the agencies that survived the commission cuts were the ones whose customers had already noticed that.

That is the deal the whole intermediary layer of travel was built on, and it is the deal an agent's owner is now offering to rewrite in two directions at once. The owner keeps the percent. The business keeps the mistakes. And the agent that stands between the two, the thing the customer actually talks to, follows instructions the customer cannot read, written by the party that keeps the percent.

A fee is a promise to answer for something. A fee without the promise is a toll.

A toll is not a scandal. Roads have them. But a toll road does not pick which exit you take, and the Visa network, which takes its percent and answers for very little, at least does not write the merchant's terms of service for him. What Meta described in October is a toll with an opinion. It takes a share of the trip, it disowns the errors of the thing that booked the trip, and it decides what the thing says when you want your money back. In my old business that combination would have lost you your accreditation.

The side that would carry it

The first business customers to read those terms as terms, rather than as news, were banks, and they were Canadian.

On the evening of October 27 Dave McKay, the chief executive of RBC, posted on LinkedIn that "nothing is more important than the security of client information," and that "if AI is going to move beyond the frontier and into the broader economy, trust will matter as much as capability." The next day the bank confirmed it would block third-party personal AI agents from direct access to its authenticated properties, online banking included. The internal memo, which Bloomberg saw, named Meta's Muse as the kind of agent it meant and gave the reason in the bank's own words: letting such agents into banking systems "can create unacceptable customer risk" by "acting beyond customer expectations or creating liability exposure." Not fraud. Not a breach. Liability exposure.

By the end of October 28 the rest of the Big Five had answered the same question. TD "made the decision to block all third-party personal AI agents from direct access to banking information, where authentication is required," while it builds the safeguards. BMO "does not permit AI agents to access our digital properties or execute transactions." CIBC does "not support personal AI agents directly opening or accessing accounts." Scotiabank will limit them while it monitors. National Bank is watching. In the United States, Charles Schwab's chief executive said the firm is "actively blocking unauthorised AI agents attempting to move clients' money." A week after Zuckerberg named a percent of the value, the institutions that would have carried the risk of the agent's mistakes, under terms that say the mistakes are theirs, declined to let the agent in.

Read the way it was reported, this is a security story, and the banks said security because banks always say security. Read against the terms, it is a pricing decision. A bank is the one business customer that already knows exactly what an agent "acting beyond customer expectations" costs, because it has been paying for that under its own name for a century: the wrong transfer, the unauthorised trade, the account closed on a bot's say-so. It knows the percent the agent's owner would take, and it knows the phone call it would get, and it has put a price on the gap. The price was no.

Cory Doctorow, writing the same week, got to the merchant's half of this and stopped. Ecommerce sites, he argued, "don't want to be legible to automated tools," because the money is in the opacity, the drip pricing and the junk fee and the surveillance price, and so "far from welcoming bots, ecommerce sites were always going to block them." True, and it is the half I wrote about last month: the mass agent met a locked door because incumbents earn on what the agent cannot see. The banks are the other half, and the more interesting one. They are not protecting a junk fee. They are refusing a counterparty who wants to be paid like an agent and sued like a road.

What the percent follows

Muse will get into banking. Not this year, and not on these terms, but a bank's door is a negotiation, not a wall, and the price of the key will be the thing RBC's memo named. Somebody will answer for the agent's mistakes in writing, with a cap and an indemnity that run the right way, and the percent will be set against that. The travel version is further along, because travel has had agents for a hundred years and already knows what they cost. Expedia signed on as a Muse connector; Booking stayed out. The one that signed up is betting it can be the agent's vendor rather than the user's and still be the one who answers when the hotel is overbooked, because answering is the thing the agent's owner has just told everyone, in a contract, it will not do.

Which brings me back to the help page, because the help page is where this ends up for the rest of us, the people who are not banks and do not get a memo. When the agent makes the mistake, the terms say it was the business's fault. When the business turns you away, the business says it was the agent's. And when you go to the one door that is still open, the support assistant, it has been told, in a block you were never meant to see, not to mention the regulator and not to cite the law. The instructions were a bug. The design was not.

In every version of this trade I have ever seen, the percent inevitably followed the answering. Airlines paid agencies while agencies answered for tickets, and stopped when they stopped. Card networks earn their basis points on a chargeback system that actually refunds you. The company that collects a percent on your trip, disclaims the errors of the thing that booked it, and briefs the thing against your exit has not invented a new kind of agent. It has invented a middleman with the commission and without the job, and the banks have just told it, in the only language a platform reads, what that is worth.

—TJ