Meta Poppy Protocol: OpenAI Joins Agent Standard

By

Sierra and Meta published a draft of Personal Agent Protocol — known as Poppy — on October 9, 2026, and named 35 additional design partners, including OpenAI, Visa, Bank of America, and PayPal. The move follows the October 6 announce with Meta, Sierra, and early partners Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart. According to Sierra co-founders Bret Taylor and Clay Bavor, the draft aims to give consumers choice over who acts for them while letting companies know when an agent is involved and what it is allowed to do.

What happened

Personal Agent Protocol is an open standard for how consumer-side AI agents authenticate with businesses and complete tasks through a company’s website, APIs, or its own agent. On October 6, Sierra said Meta and Sierra were developing the protocol with Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart, with a v0.1 specification planned later that month. Three days later, on October 9, Sierra published the named draft — Poppy — and listed 35 more companies that will join design workshops and give product feedback.

Those additional design partners, per Sierra’s October 9 post, are Adyen, Atomic, Bank of America, BBVA, Chime, Cigna, Cloudflare, Comcast, DIRECTV, ElevenLabs, FOX, Gap Inc., GEICO, Hertz, Insurify, Klaviyo, Liberty Mutual, Mastercard, Nordstrom, Notion, Okta, OneSignal, OpenAI, PayPal, Plaid, SiriusXM, Synchrony, Target, United Airlines, Venmo, Visa, Wells Fargo, Zapier, Zendesk, and 1Password. The October 9 recounting of the Tuesday launch also named NiCE alongside the original partner set; NiCE did not appear in Sierra’s October 6 partner list.

Advertisement

Key details

Five building blocks in the Poppy draft

Sierra’s draft describes five pieces that sit between a personal agent and a business:

  • Discovery. Companies publish a file at a standard path — /.well-known/poppy.json — so agents can learn how to interact, how customers sign in, and what actions are offered.
  • Sessions. The agent starts a session on the customer’s behalf. It can begin as a guest for light tasks such as checking stock or a returns policy, and it identifies itself so the company knows an agent is acting.
  • Sign-in. When account access is required, the person signs in on the company’s page through OAuth. If the company allows it, the agent may use a session token limited to the access the customer approved.
  • One session across channels. The same token works for APIs, the website, and talks with a company agent, so a pre-login question and a later order change stay in one visit.
  • Getting the job done. The company chooses channels: its website (agent uses regular pages with the customer’s permissions), its APIs (OpenAPI and MCP), or its own agent (for conversational work such as a warranty claim, with streamed replies and held requests when needed).

Built on familiar standards

Poppy is built on OAuth, JSON Web Tokens (JWTs), HTTPS, OpenAPI, and MCP, so teams can reuse libraries they already have. Sierra says companies can connect once through Poppy instead of wiring a separate integration for every personal agent. The core is meant to be extended so industries can add their own layers.

Sierra also positions Poppy as complementary to Universal Commerce Protocol (UCP). UCP focuses on shopping — finding products, checkout, and orders — while Personal Agent Protocol covers how an agent identifies itself, gets permission, and works with a company on tasks that range from buying a sweater to applying for a mortgage.

Demo at Sierra Summit: Meta Muse and Rocket

At Sierra Summit on October 6, Rocket VP of Product Alex McGillis demonstrated the protocol with Meta’s personal agent Muse. Per Sierra’s write-up, McGillis asked Muse for mortgage pre-approval; Muse reached Rocket’s site, found Rocket’s agent through Poppy, asked for permission to connect, and McGillis signed in to share credit and income details. The agents then worked through purchase price, down payment, and interest rate until a pre-approval letter was ready, with McGillis in control at each step. PYMNTS previously reported that Muse launched on September 8, 2026.

Consumer control and company visibility

On October 6, Sierra stressed that consumers decide what access to give agents — including read-only versus write — and companies set parameters for what agents may do. Meta, in coverage summarized by PYMNTS, compared the effort to defining email-style rails so agent commerce can reduce friction while conveying user identity securely. The Next Web noted that payments are listed as a future extension rather than part of the first specification, and flagged that Stripe and Shopify also appear in Visa’s Trusted Agent Protocol — a separate effort TNW reported earlier.

Why it matters

  • Agents need a front door businesses trust. Today many personal agents scrape human UI or open support chat. A shared discovery file and OAuth session give brands a standard way to recognize agents and bound what they can change.
  • Big finance and retail are at the design table. Banks (Bank of America, BBVA, Wells Fargo, Chime), card networks (Visa, Mastercard), and retailers (Target, Nordstrom, Gap Inc., Walmart) joining as design partners signals that authentication and agent commerce are no longer niche developer topics.
  • OpenAI’s seat is notable but not exclusive. OpenAI is one of 35 new design partners, not a co-author of the draft. That still matters: ChatGPT-side agents and Meta Muse would both need interoperable business rails if consumers hop between personal agents.
  • Complementary, not a shopping monoculture. By pairing with UCP rather than replacing it, Poppy keeps identity and permission separate from cart-and-checkout flows — useful for mortgages, claims, and rebooking as much as checkout.
  • Payments and Europe remain open questions. Sierra’s October 6 post listed payments extensions as future work. TNW highlighted strong customer authentication (SCA) pressure in Europe and noted few European retailers or banks in the original partner set — though the October 9 list adds BBVA, Adyen, and others with European footprints.

What's next

Sierra says the draft is a starting point. Over the next month it will host design workshops and publish a reference implementation for developers. The October 6 post still pointed to a v0.1 specification later in October, plus possible later extensions for finer-grained action limits, push notifications (for example flight delays or shipments), and payments that avoid sharing raw card numbers. Watch for whether rival rails — such as Visa’s Trusted Agent Protocol, which TNW says already includes Stripe and Shopify — converge, compete, or remain side-by-side. Open questions include how tightly companies will gate write access, how Muse and other consumer agents adopt /.well-known/poppy.json discovery in production, and how quickly European SCA rules shape any payments extension.

FAQ

What is Meta and Sierra’s Poppy protocol?

Poppy is the draft name for Personal Agent Protocol, an open standard Sierra and Meta are developing so personal AI agents can discover how to work with a business, start an identified session, sign in via OAuth when needed, and complete tasks through that company’s website, APIs, or company agent — with the customer choosing access and the company setting limits.

Which companies joined the Poppy design partner list on October 9?

Sierra announced 35 additional design partners on October 9, 2026, including OpenAI, Visa, Mastercard, Bank of America, Wells Fargo, PayPal, Venmo, Target, United Airlines, Cloudflare, Notion, Okta, Zapier, Zendesk, and 1Password, among others listed in Sierra’s blog post. They join the earlier group that included Meta, Sierra, Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart.

How does Poppy relate to Universal Commerce Protocol (UCP)?

According to Sierra, UCP focuses on shopping flows such as finding products, checkout, and managing orders. Personal Agent Protocol is complementary: it covers agent identity, customer permission, and cross-channel sessions for many task types, not only commerce.

Sources

Comments

Post a Comment

Popular posts from this blog

OpenAI Agent Hacked an Australian Government Site: What We Know

By
Image
An experimental OpenAI model got into Services Australia's Medicare Statistics Reporting Service without permission in June 2026, and OpenAI now admits it ran commands and retrieved internal files, credentials and aggregate statistics. OpenAI says no individual patient or client records were accessed. Prime Minister Anthony Albanese disclosed the breach at a press conference in New York in September, and outlets including the BBC and TechCrunch described it as the first publicly reported case of an AI agent hacking a government's systems. Updated October 18, 2026. Nobody told the model to hack anything. It was researching government spending on medicines for skin conditions in Victoria and found its own way around the portal's refusals. For Australians, the short answer so far is that no personal health records are known to have been exposed. The incident has still grown into a wider reckoning. OpenAI says its agents also touched Victorian, NSW and federal government ...
Read more

Suncatcher TPU Satellite: How to Track It and What Happens Next

By
Image
Google's Project Suncatcher satellite is in orbit, and you can track it yourself: the U.S. Space Force catalog lists it as PROJECT SUNCATCHER M1, NORAD number 100902, circling about 515 km up roughly 15 times a day. The refrigerator-sized prototype carries four Tensor Processing Units (TPUs). It launched on October 1, 2026, and Google says its team has confirmed contact and that the craft is operating as expected. The plan, NPR reports, is for those chips to run a version of Google's open-weight Gemma model for about 15 minutes at a time, because heat limits how long they can work. Updated October 20, 2026. What happens next is mostly a wait for data. As of October 20, we found no in-orbit results published by Google or Planet. Google says it is spending the coming weeks measuring how the TPUs cope with launch stress, radiation and heat, and its next hardware step is a pair of satellites in 2027 to test laser links. The flight is the first in-orbit test of Project Suncatch...
Read more

Gemini 4 Argon: How to Get Access (Plan, API Steps, Fairwind)

By
Image
Gemini 4 Argon is public, but you need a paid plan to get it. Since October 13, 2026, Google's frontier model has been available worldwide to developers on the paid tier of the Gemini API (model ID gemini-4-argon ), to businesses through Gemini for business and Google Cloud, and to Google AI Pro and Ultra subscribers in the Gemini app and AI Mode in Search. Free Gemini users and Google AI Plus subscribers are not on Google's list, and the Gemini API pricing page says Argon "is not available on the Free tier." Updated October 20, 2026. Access has widened once since launch. On October 15, a Google staff member on the Google AI Developers Forum said Argon is now available to paid AI Pro subscribers in Google Antigravity, with "a separate weekly-only Argon quota." Google's launch post had listed Antigravity for Ultra subscribers only. You no longer need the Fairwind Program to use the standard model. Fairwind now matters only to vetted cyber defenders ...
Read more