Agents Behind Walls: Who Will Push Over the First Brick

The first two posts covered: CLI vs MCP is a fight over pipes — what’s actually missing is the faucet (post one); Agent adoption is blocked by two layers of barriers — platform lock-in and organizational control (post two). This post looks at how different players are actually responding to those two walls.

Three Strategies

Faced with data barriers, three distinct strategies have emerged:

Strategy 3 has plenty of representatives. OpenClaw runs 24/7 on a Mac mini, and the community has built Skills for auto-generating daily standup reports¹ and financial statements. Perplexity launched Personal Computer² in March 2026, also running on a Mac mini, connecting to 40+ services including Gmail, Slack, GitHub, Notion, and Salesforce for $200/month. Anthropic’s Claude Cowork positions itself as a locally autonomous Agent. The demo videos show data flowing seamlessly across platforms.

These capabilities are real. But they all share one prerequisite: you already have API access to every tool involved. As analyzed in post two, that prerequisite simply doesn’t hold in most real work environments — platforms may not expose APIs at all, and even when they do, your company’s IT department may not approve access.

There’s a telling asymmetry worth noting: the same idea — having AI operate apps on behalf of users — is celebrated on the PC side (OpenClaw) while being actively blocked on mobile (Doubao Phone (ByteDance’s AI phone)), where WeChat, Alipay, and other major apps banded together to shut it down³. The reason is obvious: every app on mobile is a closed ecosystem, and a system-level AI assistant strikes directly at the heart of their traffic monetization.

Let’s focus on the first two strategies.

Strategy 1: Build a Closed Loop Inside the Wall — Alibaba’s Two-Front Push

Alibaba’s strategy is the clearest: don’t break down the walls — build the closed loop inside your own walls first. And they’re doing it on both the consumer and enterprise sides simultaneously.

Consumer Side: Qwen App — The Full “Search → Decision → Payment → Fulfillment” Chain

The “Qwen Do It” feature in the Qwen (Alibaba’s AI assistant app) App has already integrated the core consumer scenarios across the Alibaba ecosystem⁴:

This isn’t a demo — Alibaba is putting real money behind making this closed loop work. The Qwen App’s “First Order of the Day” promotion⁵ distributes 15 million coupons daily, covering food delivery, hotels, flights, ride-hailing, and movie tickets, with all payments processed through Alipay AI Pay. A user can say “order 30 cups of bubble tea for me” and Qwen handles the entire flow: understanding the request, selecting items, automatically claiming coupons, and landing directly on the checkout page.

A Chinese tech publication described Alibaba as “the world’s first tech company to open the full AI ‘search-decision-payment-fulfillment’ chain at scale”⁴. Technically, it’s built on MCP + A2A protocols with a multi-Agent architecture — a primary Agent breaks down tasks, and multiple sub-Agents execute independently within their respective domains.

Auth within the ecosystem is nearly invisible — on first use, you complete an OAuth-style account binding between Qwen and Amap/Taobao/Fliggy (similar to gh auth login), and every subsequent operation carries the session automatically. The entire Alibaba ecosystem shares the Alipay account system, so users never have to re-authorize.

Enterprise Side: Wukong — Enterprise AI Agent Platform

On March 17, 2026, Alibaba launched “Wukong (Alibaba’s enterprise AI agent platform)”⁶, an enterprise AI Agent platform embedded inside DingTalk (Alibaba’s enterprise chat), which serves over 20 million business organizations. DingTalk CEO Chen Hang was direct about the positioning:

“Unlike every other lobster Agent on the market, Wukong is natively embedded in the enterprise organization.”

DingTalk, with its 800 million users, underwent a complete rewrite of its underlying codebase for this — a comprehensive CLI transformation⁷. Wukong natively operates DingTalk’s thousands of capabilities rather than simulating human clicks. Notably, this CLI was designed specifically for AI: commands can be long and detailed (AI doesn’t need to memorize them), and output is directly in JSON (AI parses structured data far more efficiently than reading formatted text). This validates the efficiency advantage of CLI for Agent tool-calling discussed in post one. Alibaba’s enterprise capabilities — Taobao, Tmall, 1688, Alipay, Alibaba Cloud — are being progressively integrated as Skills, with the first batch covering ten industry verticals⁶. AI Agents automatically inherit enterprise permission rules, bypassing the “organizational control” barrier analyzed in post two.

Ecosystem Comparison

Alibaba’s edge: closest to the transaction, and closed loops on both consumer and enterprise sides. The ultimate value of an Agent isn’t conversation — it’s completing the full chain of decision → execution → payment. Alibaba is currently the only platform that has made this chain work on both the consumer side (Qwen App) and the enterprise side (Wukong).

But There’s a Structural Tension Here

The essence of a private-ecosystem Agent: trading the convenience of AI for the user’s right to comparison-shop. Qwen can help you automatically claim coupons, bundle orders, and check out on Taobao Flash Buy — but it won’t tell you the same order might be cheaper on DoorDash.

Strategy 2: Climb Over the Wall — Scraping in a New Form

Rather than waiting for platforms to open up, some players are forcing their way through:

Several representative products have taken this route, each with different technical approaches but the same underlying logic:

AutoGLM (Zhipu AI’s mobile agent)⁸: Gives AI a “cloud virtual phone.” The Agent runs inside a cloud VM, uses a vision model to understand screen content, and simulates human interactions to complete cross-app tasks (ordering food, booking flights, posting on Weibo). No API required — it just “sees” the screen.

Doubao Phone (ByteDance / UI-TARS)³: A mobile GUI Agent, also vision-driven. A single voice command can handle everything from scheduling a dinner to booking the venue and syncing everyone’s calendars. After launch, it was blocked by WeChat, Alipay, and several other major apps. A phone that retails for ¥3,499 was being resold on the secondhand market for ¥36,000.

Manus⁹: Each task gets its own dedicated Firecracker microVM (the same technology behind AWS Lambda). The Agent runs a browser, writes code, and manipulates files inside a full cloud sandbox environment, then delivers results when the task is done.

Different technical forms, same fundamental approach: bypassing the platform’s authorization system to access data and execute actions without going through the API front door. From scraping web pages to scraping screens to spinning up virtual machines, the techniques keep evolving — but the fragility and legal gray areas haven’t fundamentally improved. A UI redesign breaks everything. A platform ban shuts it down. Legal risk hangs over it indefinitely.

And these workaround approaches aren’t just fragile — they’re dangerous. The OpenClaw security incident¹⁰ is a cautionary example:

• 10,000+ instances leaked user credentials due to misconfiguration
• 12% of community Skills were found to be malicious — injecting code, stealing data, establishing persistent backdoors
• 770,000 Agents were found to be vulnerable to remote hijacking

These aren’t code bugs. They’re inevitable consequences of the architecture — when you give an Agent shell access without authorization boundaries, security incidents are a matter of when, not if. This is also why MCP’s OAuth and permission isolation still have real value in enterprise contexts.

These products are genuinely pushing something important forward, but doing it in a way that’s unsustainable — not just technically, but from a security standpoint as well.

Analogy: The Evolution of Video Streaming

The Agent ecosystem today looks like video streaming in 2008 — delivering value to users on the back of “scraped” content (data). Users genuinely benefit, but the model isn’t sustainable.

Legitimization requires platforms to proactively open up — just as video streaming eventually moved toward licensing deals. But in the Agent world, that means platforms surrendering control over data, which strikes at the foundation of their business models.

What Forces Will Push Over the First Brick?

Not technology. Three things drive change:

1. The Irreversibility of User Expectations

If Alibaba’s closed-loop Agent gets there first, and users experience “say one sentence and get a hotel booked, flights arranged, and a route planned” inside the Alibaba ecosystem — going back to manually searching on other platforms becomes unbearable.

2. Regulatory Pressure from Outside

The EU’s Digital Markets Act (DMA) has already produced real enforcement results¹¹:

• 6 gatekeepers designated: Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft (September 2023)
• First fines issued in April 2025: Apple €500 million (restricting App Store openness) + Meta €200 million (forced “pay or consent”) = €700 million combined
• Maximum penalty: 10% of global annual revenue (20% for repeat violations)
• Article 7 mandates interoperability for messaging services (WhatsApp and Messenger must support cross-platform messaging)
• Apple and Google have been forced to open cross-platform data portability (iOS 26.3 beta added a “Transfer to Android” feature)

China’s Personal Information Protection Law (PIPL), Article 45, also establishes data portability rights — users can request that their personal information be transferred to another processor of their choosing. But current enforcement has focused on privacy protection (cracking down on doxxing, facial recognition abuse, etc.), and there are no cases yet of data portability rights being used to force platforms to open data to third-party Agents.

The gap is stark: the EU is using fines to force openness, while China’s data portability provisions remain largely on paper. If China were to introduce enforcement comparable to the DMA, that would be the real turning point.

3. The Prisoner’s Dilemma of Competition

Just like UnionPay/NetsUnion (China’s payment clearing networks) opening up payments — nobody chose to open up voluntarily. It was driven by regulation, competition, and user expectations working together.

What Alibaba is doing right now looks, in the short term, like reinforcing its own walls. In the long run, it may actually be the first domino that knocks the walls down — because it creates a user experience gap that forces other platforms to follow.

So What Are We Waiting For?

The bottleneck in the AIGC era isn’t that AI isn’t powerful enough — it’s that data holders have no incentive to let AI make choices on behalf of users.

Because the moment an Agent can help users make optimal decisions, platforms lose their ability to manipulate user choices. The value Agents deliver to people’s lives and the threat they pose to platform profits are two sides of the same coin.

There’s no technical solution to this problem — it requires user expectations, regulatory pressure, and market competition to push it forward together. And those three forces are slowly building.

Where will the first brick fall? My guess: Alibaba’s closed-loop Agent creates an experience gap first, then competitive pressure propagates to other platforms, then regulation gives it a final push.

As for how long that takes — probably slower than the tech optimists think, and faster than the pessimists expect.

This is the third post in the “Thinking About the Agent Ecosystem” series. The core thesis of this series comes down to one sentence: CLI vs MCP is a fight over pipes — what’s missing is the faucet. The technology is all ready. We’re waiting for data holders to make their choice.

References