On 2026-10-03 ChatGPT shipped Finances at chatgpt.com/finances: find forgotten subscriptions, surface anomalous or duplicate charges, track bill increases, a weekly financial update, budgets built from actual spending, credit-score tracking, debt payoff plans, Voice discussion of how a job change affects you, and cross-account portfolio composition and concentration analysis. The interesting decision is not the feature list. Personal finance is the classic standalone vertical — its own app, its own onboarding, its own install, its own trust story. Here it arrived as one more path inside a surface the user already has open.

In the same stretch, Peter Yang argued (2026-09-21) that an agent living inside an existing chat app like iMessage “doesn’t make sense”, and that Muse — its own app, plus Meta pushing it across the product line — becomes the likely leader. Anthropic’s redesigned Claude Projects (2026-09-19) took the other route: same surface, new behaviour, work that keeps running after you leave the desk and can be followed up from the phone. Two working builders, two opposite readings of one question: does the capability get its own surface, or rent someone else’s?

What I concluded

The entry point is now the dominant packaging decision for agentic features, and on this evidence most of these teams are choosing it correctly. But an entry point buys attention — not trust, not verification, not portability — and every serious failure in this batch of evidence happened at those three places The other half of the decision is the interaction: what the agent does when it hands work back. Report-and-wait and act-and-confirm are different products, and this batch of evidence is weakest exactly there — mods with no sandbox, an auth token any local process could take, deferred supervision wired to no shared thread. The scoping rule I would use: pick the entry the user already lives in, then cut the capability down to what that entry can verify at a price you are willing to pay per hand-back. Autonomy you cannot verify is a demo, not a feature. Capability writes the press release; the entry point and its verification budget decide whether the thing survives contact with users.

Constraints

Distribution is the scarce good. WeChat Mini Programs are the precedent: third-party capability distributed inside a super-app’s existing entry point rather than as separately installed apps. Apple formalises the same idea with App Intents, the API that exposes an app’s capabilities to the operating system’s entry points. OpenAI’s developer docs list, as first-party primitives inside ChatGPT: “Sign in with ChatGPT”, apps powered by a user’s ChatGPT plan, plugins for ChatGPT and Codex, Workspace Agents, Commerce, Ads and MCP connections. Distribution inside a surface is now something you buy into; Anthropic’s MCP announcement frames the other half — integrations were the fragmentation, and a protocol is the attempted answer.

The trust boundary is scope, not a hardening pass. Claude Code mods let a few lines of TypeScript rewrite prompts, add UI or replace built-ins, ship with plugins, and carry Claude Code’s permissions with no sandbox — plus an explicit warning to install only trusted sources. Meta’s Muse had real personal-agent entry points and a 0-day in which any local app or terminal command could obtain the account’s auth token and take full control of the agent; Patrick Wardle reported several proof-of-concept attacks, and Meta shipped a hotfix roughly 12 hours after disclosure. Amazon had already begun blocking Muse’s shopping functionality as an unauthorized agent.

Verification cost decides autonomy. Greg Kroah-Hartman’s Kernel Recipes 2026 talk examined Anthropic’s Mythos claim of 79 kernel vulnerabilities: per a transcription of the slides, 24 had no detail, 14 were not vulnerabilities, 3 involved fabricated data and 15 were already fixed — only 20 needed fixing. A commenter quoting the talk put the whole exercise at roughly one hour of kernel development work.

Regressions are silent by default. Anthropic’s postmortem covers three independent changes affecting Claude Code, the Claude Agent SDK and Claude Cowork, API unaffected, all fixed on April 20 in v2.1.116. One was a March 4 change to Claude Code’s default reasoning effort, high to medium, to ease latency some users read as an interface freeze — a tradeoff the postmortem calls wrong, rolled back April 7, affecting Sonnet 4.6 and Opus 4.6. Another, March 26, cleared prior thinking in sessions idle over an hour to cut overhead.

User assets have to be portable. Yang’s advice: design skills and files so they migrate between harnesses and agents, or half your time goes to moving house.

Shared context is unsolved. You cannot pull a spouse into a Muse chat to plan a holiday or a colleague into a ChatGPT or Grok Bot thread; multiplayer AI is still mostly “at the bot in Slack”.

The options, and what I traded away

Evidence

Garry Tan (2026-10-03) called Capy a “24/7 standup for agents” and described a cross-session case: a round of fixes initiated by his GBrain collaborator Sina automatically routed around work he had in flight across several Capy threads, model-agnostic. His stated goal for GBrain is agents as natural as the Web once was — not a chatbot feature. That is the “presence, not chat” version of the entry-point argument, and it is the strongest datapoint here for the position Yang stakes out.

The counter-datapoints are all about the hand-back. Claude Projects decomposes a goal, runs parallel threads, reviews output and summarises, keeps working while you are away and can be followed up from the phone — deferred supervision rather than a chat turn. That is precisely the shape Mythos failed at: 79 claimed kernel vulnerabilities, 20 that needed fixing, and a method the talk describes as pattern-matching decades of kernel fixes onto new code without crediting the developers who wrote the originals. An autonomous auditor’s output only becomes a product claim after someone else re-verifies it.

Then there is the permission layer — mods without a sandbox, Muse’s token theft, Amazon blocking an unauthorized agent — and the regression layer, where three changes shipped, did what they were meant to do, and still degraded quality until v2.1.116. And there is the entry point’s own moat: cross-account analysis works because the surface already holds the account.

Where this stops being true

This is scoped to consumer and prosumer subscription surfaces — redesigned Claude Projects reached some Pro and Max subscribers first — and to single-user personal agents. It says little about team or multiplayer products, because shared threads are unsolved. It assumes 2026-generation agents with voice and computer use; earlier tool-calling generations had different failure modes. Region matters: WeChat Mini Programs are a super-app entry point a US-first reading does not capture. Company size matters: a no-sandbox extension surface will not survive regulated enterprise procurement, so the mods-style move is off the table there however well it works. Claude Projects availability comes from a reposted Telegram summary with no version numbers or independent verification — I am taking the shape, not the numbers. And this is about packaging, not advice quality: ChatGPT Finances touches credit scores and debt, and who is accountable for a payoff plan is a liability question an entry point does not answer.

What I would do differently

• Write the verification budget before the feature list. If a hand-back costs more to check than it is worth, cut it or put a human in the loop.
• Decide the permission model in the same document as the scope. Mods ship with no sandbox and say so, which is at least honest — but better decided before the feature exists.
• Instrument for silent regressions. The postmortem’s real lesson is that a latency fix which changes the default reasoning effort is a product change, and it needed an eval, not a config flag.
• Resist “one surface for work and personal”. Yang’s point about ChatGPT’s structural contradiction is the same tension automakers hit when one HMI has to serve a driver and a fleet operator; the two audiences want different defaults, permissions and proof.
• Decide the portability format early, and state what leaves with the user.
• Ship the report before the action wherever the user cannot cheaply verify the action.

This post is part of my personal AI agents guide.