in this issue
When Your Customer Sends an AI Agent in Their Place
How CX leaders can prepare for personal AI agents contacting their brands across voice and digital channels.
Contributed by: Ping Wu, CEO of Cresta
With the increasing availability of personal AI agents, customers can dispute unfamiliar charges, find a cheaper flight, or move an appointment without doing the work themselves. Their agent can search a website, use chat or messaging, make a call when needed, and return with necessary information.
For the customer, that is undeniably appealing and convenient.
For customer experience (CX) organizations, it changes the economics of demand and raises more difficult questions: How to plan for volume across channels? What authority does the agent actually have, and where does liability lie? How should they route a request when the customer is no longer interacting directly?
Here, we’ll lay out the challenges personal AI agents will bring to the enterprise, and what CX leaders should do now to prepare their operations.
Challenge #1: Lower Consumer Effort Can Mean More Demand
The first effect will be more contacts, across channels. This is Jevons paradox: when something gets cheaper to do (and lower friction), people do more of it.
Today, contacting a business costs the consumer real effort, and often, real frustration. They may search a website, try a chatbot, sit through an IVR menu, wait on hold, and oftentimes repeat their information multiple times.
A personal agent completely removes this friction: it can try digital channels first, doesn’t mind a 40-minute hold, and can contact 5 different businesses in parallel, all without ever running out of patience.
The economics are asymmetric. The consumer’s cost per contact drops sharply, while the business still bears the cost of every interaction, from chat to phone queue. And the reality is that for many requests, there is no downside to asking; a consumer has nothing to lose by asking their agent to seek a lower cable rate each month, or shop around the moment a discount expires.
For operations, this means forecasting models trained on historical human behavior may undercount demand, and the mix may shift toward short, repetitive, high-intent contacts across channels. Any subscription-based products and services whose retention relies on a difficult cancellation process should prepare for pressure. The same request may start in chat, involve SMS, and finish by phone–so forecast both contacts and completed customer tasks.
AI Caller Readiness Checklist
-
Measure the share of your inbound calls that come from AI agents today, by intent and queue.
-
Re-forecast volume for agent-driven demand, starting with retention, rebooking and rate negotiation.
-
Bring the voice channel under the same security review as your public APIs, including a plan for queue flooding.
-
Write an agent caller policy: which requests agents may complete, and which need the consumer’s direct confirmation.
-
Decide your front door position: block, gate or embrace, by request type.
-
Plan the move from IVR to an agentic voice front door with AI caller detection built in.
-
Give frontline reps real-time alerts and guidance for AI callers, and train them on simulated ones.
-
Join or start the industry conversation on an open agent-to-agent protocol for telephony.
Challenge #2: Access & Security Must Work Across Channels
Digital channels already have some controls that phone lines lack, such as authenticated sessions and request limits. But those controls may have been designed for people using a site or app directly. A personal agent can operate a browser, use chat, and call a representative in pursuit of the same request. A limit in one channel offers little protection if the activity continues elsewhere.
A contact center is effectively a human API to enterprise systems: a customer states a request over voice, chat, or messaging, an agent authenticates them, and the system reads from or writes to CRM, billing, and order systems on their behalf.
Many service workflows assume a human is making the request, an assumption that inherently limits how often someone could repeat the same attempt.
That assumption no longer holds. Once software can converse by phone, navigate a site, and use chat at scale, familiar API-style attacks can target service workflows across channels. CX and security teams must treat all channels available to customers with the same rigor as their public APIs.
Challenge #3: The Law Hasn’t Caught Up on Authority and Liability
Regulation is behind on the basic question of who an agent speaks for. Contact centers already handle third parties: authorized users on an account, a family member with power of attorney, a caregiver. Each has a defined process, usually involving paperwork and a verification step.
A personal AI agent may not fit those established processes. Disclosure can help identify AI, but it does not establish what that AI is authorized to do. When it contacts a business, a representative or automated system must determine which customer it represents, for which requests, and within what parameters.
The harder problem is repudiation. Suppose an agent changes an airline booking online or by phone, accepts a fare difference…and the consumer later says they never asked for that. Who is liable: the consumer, the agent provider, or the business that accepted the instruction?
Existing rules do not answer this cleanly. Analysts note that it is still unresolved whether an AI agent’s authorization satisfies Regulation E1 for payments, which leaves merchants exposed to disputes they may not be able to win.
CX leaders should not wait for the rules to settle. Set your own policy:
Decide which request types a personal agent may complete in each channel: information only, low-risk changes, account changes, or payments
For consequential actions, confirm with the consumer through a trusted channel you control, such as an app notification or a text to the number on file, before executing
Record and retain every agent-initiated interaction, so you can show what was requested and what was confirmed should a dispute arise later
Challenge #4: Every Business Needs an Agentic Front Door Policy
Each business will have to decide for itself whether to serve personal agent traffic on the phone, on the web, and through chat or messaging. The first decisions are already public: Amazon blocked Muse from shopping on its site,2 citing unauthorized access and concerns about how the agent did (or did not) identify itself.
There are three broad positions a business can take:
BLOCK
- What it means: Refuse agent traffic and require the consumer to act directly
- Fits when: You own the customer relationship and monetize the human session, for example through ads or merchandising
- Risk: Consumers whose agents cannot reach you may go to a competitor whose front door is open
GATE
- What it means: Serve agents that identify themselves, for a defined set of low-risk requests
- Fits when: Your policy and detection are still maturing, works for most enterprises as a starting point
- Risk: Requires reliable detection and a clear list of what agents can and cannot do
EMBRACE
- What it means: Offer a fast, structured path for personal AI agents, with authentication built for them
- Fits when: Your service is commoditized, or speed and availability are how you win
- Risk: More exposure to the security and liability issues above
This is both a strategic and operational choice. If personal agents become a common way to comparison-shop and resolve issues, a business that is hard for them to reach may lose customers. Detection differs by channel: web sessions, chat behavior, and voice signals each offer partial evidence. The policy has to work even when the business cannot identify every agent with certainty.
What CX leaders should do now: The Analyze, Automate, and Augment framework
Analyze: Get visibility into every interaction
Analyzing agent-initiated contacts across voice, web chat, and messaging shows you:
- How much of your volume may be agent traffic, by channel, and how fast it is growing
- Which intents, products, channels, and queues agents reach most often
- How those contacts end: resolved, escalated to another channel, abandoned, or completed with an action the consumer later disputed
- Patterns that suggest abuse, such as bursts of identical requests, repeated failed verification, or scripted probing of your policies
This is the evidence base for every other decision: whether to block, gate, or embrace agents, which requests to automate, how to re-forecast staffing, and where detection is missing things.
Automate: Modernize the front door across channels
Personal agents should accelerate a migration already underway, from traditional IVR menus and rigid chatbots to an agentic front door across voice and digital channels.
This conversational AI layer identifies the request, and where possible, whether it came from a person, a disclosed personal agent, or an unidentified automated source. It applies your policy, resolves an allowed request, or routes it with context. Identification should combine signals appropriate to the channel:
- Disclosure: Ask whether the contact comes from an AI agent and whom it represents; record the answer. Well-behaved agents will say so (or be required to by law)
- Audio: Synthetic speech detection that runs on the audio for the whole interaction, not only at the greeting
- Behavior: Look for repeated timing, phrasing, or requests across interactions
- Digital: Review session activity, repeated attempts, and available authentication signals in chat, messaging, and web channels
- Protocols: As agent-to-agent standards evolve, use verifiable credentials where available.
No single signal is reliable alone. Tune detection over time, and apply authorization rules even when the contact’s origin is uncertain.
Augment: Enable your workforce to work with AI-initiated contacts
Your human agents may encounter personal agents by phone, in chat, or after a digital handoff. Give them support in the moment:
- Detection and alerts: Tell the rep in real time when a contact may come from an AI agent, whether it disclosed itself, and what happened in earlier channels
- Guidance: Show what your policy allows a personal agent to do on this request, and what requires the consumer’s direct confirmation
- Reminders: Prompt the rep to confirm consequential changes through the consumer’s verified channel and note the agent’s stated authority
- Practice: Train reps on simulated voice and chat interactions, including agents that test verification
Close the Loop
Treat this as a feedback loop, not a one-time project. What conversation intelligence reveals should inform and update your front door policy, retrain detection, and change the guidance reps see.
The behavior of personal agents will change month to month, and keeping pace with this evolution requires data on every single interaction. Having this in one system that enables workflow iteration at lightning speed is critical.
Curious to see what industry leaders are already doing to detect personal AI agents? Learn about Cresta’s proprietary ensemble model, Sentry-.01, designed to recognize the conversational patterns of AI agents, based on Cresta’s in-depth understanding of human and AI agent behavior across CX verticals and use cases.
Cresta is the AI operating system for customer experience, where human and AI agents work together to power the entire customer lifecycle. Cresta automates conversations and back-office processes, augments human work, and puts insight into action, so each conversation makes the next one better. Companies like United Airlines, CVS Health, and Marriott use Cresta to turn every interaction into a competitive advantage.
Learn more at Cresta.com.