2024: Agents Browse. 2025: Agents Code. 2026: Agents Move Money.

The line is mine and I have been repeating it for months. It is not a slogan. It is the actual sequence the last three years walked through, and the order is not a coincidence.

Each year was the year the infrastructure caught up to the agent. Each year unlocked a class of work the agent could finish on its own. The order is set by how forgiving the failure mode is.

Misclicks are forgiving, wrong code is mostly recoverable, but wrong money is not.

That is the whole story.

2024: Agents Browse

Anthropic shipped Computer Use in public beta on October 22, 2024. Three months later, OpenAI shipped Operator on January 23, 2025. Both were the same shape: a vision model paired with a reasoning loop, pointed at a browser, watching the screen, clicking around. The agent was a user.

The reason browsing was the first surface to give way is not technical. It is forgiveness. If the agent clicks the wrong button, the user notices, hits back, and tries again. The error model is “retry.” The audit trail is “the user was watching.” There is no permanent damage to undo.

Browser-first agents shipped in 2024 because the infrastructure already existed. Every website was a public API the agent could call by clicking pixels. The model did not need privileged access. The bank did not need to know it was talking to a robot.

That worked for booking a flight or buying a sweater. It did not work for anything where the website held you to a fiduciary standard. Even today, a browsing agent cannot meaningfully sit between a CFO and her bank’s portal. The portal does not know what an agent is.

2025: Agents Code

Devin launched in March 2024 and went viral, but coding agents only crossed into mainstream daily use through 2025. Cursor. Claude Code. Codex. By the back half of the year, most engineers I know were running an agent for at least part of their pull-request loop.

Coding is harder than browsing in capability and easier in failure mode. The agent has to read a repository, hold thousands of lines of context, write code that compiles, and avoid breaking the tests. That is more cognitive work than clicking a date picker.

But when the coding agent fails, the failure is contained. The test suite catches most of it. Code review catches the rest. The worst that an unsupervised coding agent does in a day is open a bad pull request nobody merges. The diff is right there. The rollback is git revert.

That bounded failure mode is why coding agents iterated fast through 2025 without burning their users. The mistakes were visible and recoverable. The agent could be wrong, and the company kept shipping.

2026: Agents Move Money

Money is the year that just started. It is also the year that breaks the pattern.

A wrong wire does not roll back. The recipient gets the money. You file a recall request and wait. Sometimes it works. Sometimes it does not. The audit log matters because the money is gone before the log is read.

So the question for 2026 is not “can the LLM do banking.” The LLM has been able to draft a wire instruction since 2023. The question is whether the infrastructure exists to let an agent do banking with the same accountability a human controller has. Scoped access. Spend caps. Approval routing. An audit log a bank’s compliance team would defend in front of a regulator.

That infrastructure did not exist anywhere in 2024. Most of it still does not exist at most banks. The agent that calls a bank’s customer portal in 2026 is back to clicking pixels, with no permission scope, no audit log, and no recourse when the portal session times out mid-wire.

The banks that figure out the next layer in 2026 are the banks that publish a real interface for agents. An endpoint, with caps the bank enforces, identities the bank issues, and an audit log the bank stands behind. The agent calls the endpoint. The bank does the rest.

What an Agent-Callable Bank Actually Needs

If you are a bank reading this and wondering what “publish an interface for agents” means in product terms, here is the short list.

A tool surface the agent can read at runtime. Not a chatbot bolted onto a marketing site, an actual machine-readable spec the agent client (Claude, ChatGPT, Cursor, Gemini) can discover and call. The Anthropic standard for this is the Model Context Protocol. The OpenAI client supports it. So do the others. If your bank does not have an MCP server live, your bank is not in the conversation.

An agent-discoverable endpoint. The customer should not have to copy-paste your URL into a config file. There is a well-known convention for agent discovery (/.well-known/agent.json) that compliant clients check automatically. If your bank does not publish one, your bank is invisible to half the agent stack.

A permissions model that lives at the bank, not in the prompt. The agent should not be able to talk its way past a cap. The cap should be enforced server-side, at the API gateway, before the payment engine sees the request. If your security model is “the agent will not misbehave,” your security model does not exist.

An audit log a CFO and a regulator can both read. Every action the agent took, the prompt that triggered it, the data it acted on, and the outcome. In the same log as human actions. The only difference between an agent action and a human action should be the identity field that says which agent.

Most banks have none of this. The ones that build it in 2026 own the category for the next decade. The ones that ship a “chatbot” instead spend the rest of the decade catching up.

What Meow Has Shipped for This Layer

We have spent the last two years building exactly that. The published Meow MCP server gives an agent on Claude, ChatGPT, Cursor, or Gemini a small set of well-defined tools: send a payment (ACH, wire, or USDC), issue a card, create an invoice. The agent-discovery file any compliant agent client find the endpoint without manual configuration. The skills file documents the tool surface in a format an agent reads at runtime.

The agent itself can also open the account in the first place. Our AI-agent account opening flow lets the agent fill out the KYB on the user’s behalf, submit the application, and have the funded account ready before the user gets up from their chair. The agent is doing form work the user used to do, against the same partner-bank compliance review every account goes through.

The permissioning and audit work that makes this defensible is documented separately in the permissions model post. That is the part that turns “an agent can call a payment endpoint” into “an agent can call a payment endpoint and your CFO can defend it in front of an auditor.” Without that layer, the rest of the stack is a liability waiting to happen.

Banking services are provided by Cross River Bank and Grasshopper Bank, N.A., Members FDIC. Customer deposits are eligible for FDIC insurance through partner banks under standard limits.

Why the Order Mattered

Look at the three years together. Browsing in 2024 needed no new infrastructure; agents rode on top of the public web. Coding in 2025 needed only a sandbox and a test runner; the failure mode was cheap. Money in 2026 needed an actual primitive at the bank, because the failure mode is permanent.

If anyone had tried to ship “agents move money” in 2024, they would have shipped it on top of bank portals with no permissions, no audit, and no scoped identity. The first one would have ended in a six-figure fraud incident and a New York Times story. The category would have been set back two years.

The order was right. The browsers proved the loop. The coding agents proved the trust. Now the bank has to step up.

What Comes Next

2026 is not the end of the line. The first wave of “agents move money” is the simple stuff. Issue a card. Send a wire. Pay a vendor. Reconcile when the payment lands.

The harder workflows come after. Treasury. Accounts receivable. Foreign exchange hedging. Cross-entity sweeps. Each of those needs its own primitive at the bank, its own audit shape, its own controls. None of those exists at most fintechs today. They will get built over the next eighteen months, or whoever does not build them will lose the category.

The pattern repeats. Hard failure mode means stricter primitive means later year. The forgiving stuff goes first. The unforgiving stuff goes last.

The agent gets to be useful. You stay in control. That is the shape of the next decade.

Frequently Asked Questions

Why didn’t AI agents move money before 2026? The blocker was infrastructure, not LLM capability. Banks had not published agent-callable endpoints with bank-enforced caps, scoped permissions, and audit logs. Money movement has a non-reversible failure mode, which made the absence of those primitives prohibitive. Browsing shipped in 2024 because the public web required no new primitive, and coding shipped in 2025 because the test suite caught the failures cheaply.

What can an AI agent do on Meow today? AI agents on Claude, ChatGPT, Cursor, and Gemini can open a Meow business bank account through Meow’s agent KYB flow, send payments via ACH, wire, or USDC, issue and manage corporate cards and spend controls, and create invoices. The full tool surface is documented at meow.com/skills.md.

How does an AI agent connect to Meow? Meow publishes its MCP server at mcp.meow.com over HTTP transport. Compliant agent clients (Claude, ChatGPT, Cursor, Gemini) find the endpoint via the agent-discovery file at meow.com/.well-known/agent.json. No custom integration work is required.

Are AI-driven payments FDIC insured? Meow is a financial technology company, not a bank. Banking services are provided by Cross River Bank and Grasshopper Bank, N.A., Members FDIC. Customer deposits are eligible for FDIC insurance through partner banks under standard limits. The FDIC’s deposit insurance coverage only protects against the failure of an FDIC-insured bank.

What was the first major browsing agent? Anthropic released Computer Use in public beta on October 22, 2024, alongside the upgraded Claude 3.5 Sonnet. OpenAI followed with Operator as a research preview on January 23, 2025.

What were the breakout coding agents in 2025? Devin from Cognition launched in March 2024 and went viral, but coding agents only crossed into mainstream daily use through 2025. Cursor, Claude Code, and OpenAI’s Codex tooling were the breakout surfaces. Most engineers I know were running one for at least part of their pull-request loop by the back half of the year.

What comes after agents moving money? The first wave covers payments, card issuance, and invoicing. The harder workflows come next: treasury, accounts receivable, foreign exchange hedging, cross-entity sweeps. Each needs its own primitive at the bank. Most of those primitives do not exist at most fintechs today.

The Order Is the Story

You can tell the maturity of a category by how forgiving the failure mode is. Browsing was first because nothing breaks. Code was second because almost nothing breaks. Money is now because a lot breaks if the infrastructure is wrong.

The infrastructure is finally right. We placed our bet on the agent layer two years ago. The tools are live. The MCP server is published. The cards work. The wires settle. The agent fills out the KYB. Apply at meow.com or connect an agent at meow.com/mcp and run it yourself.