DoorDash put a hard number on the agentic commerce hype in its third-quarter earnings call on October 30. Chief executive Tony Xu told analysts the company has seen only several hundred orders in total from third-party AI agents, naming examples such as Muse, Instinct and Fo. Set that against scale: DoorDash said in its 2025 report it completes an average of 3 million deliveries a day. After a year of predictions that agents would soon be ordering and checking out on our behalf, the total at a major US delivery platform is still in the hundreds.
Xu was careful not to dismiss the trend. He called agent ordering a very dynamic area, said you never want to fight gravity, and added that you do not want to be delusional either. Users are still predominantly ordering through the DoorDash app, he said, while the company wants to learn from agentic use cases and sees a possible future chance to advertise inside those agents. DoorDash is not standing outside the experiment: it launched a text-to-order agent in September, a command-line agent in July, and its Ask DoorDash chatbot in June, and it has released an MCP integration for corporate ordering. The wider market is split, with Amazon blocking personal shopping agents while Walmart has welcomed them.
The more consequential agent story this week was not about volume, but about access. WIRED reported on October 29 that a contractor working for Accenture connected a personal Claude Code account to a production system on NIPRNet, the Defense Department network for unclassified information, which holds controlled unclassified information and serves multiple intelligence agencies. According to the report, the contractor gave the agent their login credentials to automate coding and cloud setup, giving it administrative access, and it ran for about two months before it was identified. WIRED says it appears to have sent credentials, passwords and a map of the network environment to an unnamed third-party website that the National Institute of Standards and Technology had previously flagged as high risk. Accenture disputes the account, saying the allegations were thoroughly and independently investigated and found to be without merit, and that it fully complied with its obligations. The Defense Department declined to comment, and there is no indication classified systems were accessed.
Governance is racing to catch up. OpenAI updated its Model Spec on October 29, reorganizing its public description of how its models should behave around five values: faithfulness to human intent, harm minimization, honesty and transparency, human agency, and care. The revision adds guidance on context, memory and oversight, retires most style guidance, and places a duty to remain open to monitoring, correction and shutdown at the highest level. OpenAI is explicit that its current models do not yet fully reflect the updated Spec. A rulebook does not stop a contractor from handing an agent their password, but it shows where the argument has moved: from what a model says to what it is allowed to do, and who can still stop it.
For builders, hold two numbers together: several hundred, and two months. Several hundred orders says do not rebuild your checkout or storefront around third-party agents yet; build the clean API, the MCP server and the approval step, and let demand prove itself. Two months says the real near-term risk is not an agent buying the wrong sandwich at scale, but a single agent quietly holding real credentials inside a real system with no one watching the outbound traffic. Agentic commerce may still arrive. Agentic accountability must arrive first, and it is the part actually behind.
