The open web survived because the client worked for the user and owned nothing in the page. Every agent client today belongs to a model company.
Open standards below the surface lose to closed interfaces by default. A standard below the surface is a public protocol or format that anyone can implement, nobody owns, and nobody looks at directly: HTTP, TCP/IP, MCP. A closed interface is the screen one company owns, where the standard’s output actually gets shown: the app, the feed, the chat window. Standards like that win on adoption and lose on influence. Everyone uses HTTP, and HTTP has almost no say in what a person sees, because whoever owns the surface people actually look at decides that and becomes the platform. The standard keeps working. It just sinks into the plumbing. With agents, that surface is the chat window, and the company that owns it gets to be your agent and every provider’s distribution channel at the same time. The way out is to open the interface layer itself, the way HTML opened rendering thirty years ago. Netscape, the browser that did it first, was closed source and sold for money. That never mattered, because the layer was open even though the client was not. Better protocols underneath will help and won’t be enough on their own.
This started with a LinkedIn post from Mathias Biilmann at Netlify, and it’s been rattling around my head since. His point: the web is the only platform nobody owns. Buy a domain and you’re playing by the same rules as the biggest company on earth. No one approves your app, takes a cut, or pulls your listing. Every big technology shift restarts the open-versus-closed fight, agents have restarted it, and right now the only thing holding the line is competition between agent companies. He’s right about the fight. I think the risk is bigger than the one he describes, though. App stores put a gatekeeper at the door. Agents put one on the screen.
The web is a two-party negotiation
Think about what happens when you load a page. The provider controls what gets sent: markup, layout, ads, paywalls. You control how it renders, through your browser and whatever extensions, blockers, or reader mode you’ve added to it. The HTTP spec calls the browser a user agent. It works for you, and nobody sits between the two of you.
The browser made that structural. The page is the biggest thing on screen, and everything the vendor adds is chrome around the viewport: tabs, bookmarks, sync, speed. Netscape, Internet Explorer, Firefox and Chrome fought for two decades, and the page rendered the same in all of them, or close enough that building for one browser made no sense. Netscape and Microsoft both tried to fence the format with proprietary tags, and neither could, because the other kept rendering the public one. Google owns the most popular browser on earth and still can’t dictate the terms a site operates under inside it. Rendering got standardized, so everything the browser vendor could sell was peripheral to the page: the default search engine, the new tab, the address bar. It had nothing to sell you access to inside the page.
The arrangement also came with a built-in correction. When a provider trashed the experience with popups, autoplay, or tracking, you could see it, and you could fight back with your half of the software. Ad blockers came out of exactly that. That two-sided balance, more than any protocol, is what “nobody owns the web” means in practice.
Model companies inverted it
Open any of the model companies’ desktop or mobile apps and look at what’s in the middle of the screen. It’s the model, and the conversation is the viewport now. A web page shows up as an artifact, a card, a citation, a tool result. The site’s layout, brand, checkout flow, and every design decision that used to be the product get squeezed into whatever the model feels like showing. Several of these companies ship browsers too, and the direction hasn’t changed: the agent browses, and you read the agent.
What bugs me is the word itself. Agent inherits an assumption from HTTP, that the software works for the person using it. A hosted agent app works for whoever pays the model company. The provider’s side of the negotiation collapses into a tool call, your side moves onto the vendor’s server, and both ends of the web’s two-party deal now belong to a third party.
This is deeper than gatekeeping
App stores control the door. They set the rules for getting in, take a percentage, and can throw you out. Once you’re inside, though, your interface is yours. Agents move the control point from the door to the screen. The model company decides what the user sees of you, in what order, next to whom, and whether they see you at all. Nobody ejects you. You get summarized.
The page’s equivalent in an agent is selection and framing: which tools get called, which results surface, and how much weight each one gets. On the web you can see the ad. In an agent the bias is the answer, and the summary can be bought without anyone being able to tell.
Google already ran this play once, with AMP. It cached publishers’ pages, rendered them on its own surface on its own terms, and tied placement in search to compliance. Publishers went along because distribution required it, and the whole thing only faded after years of pushback and a change in search policy. AMP at least kept the page on screen. Agents don’t.
Amazon’s marketplace is where this ends up. Every seller is present and none is ejected, and Amazon owns the page, picks which seller fills the order, sells the placement, and uses the demand data to launch its own label against them. The seller became a supplier. That’s the web as a supplier to agents. HTML and HTTP keep working, the way TCP/IP keeps working, and nobody’s business runs on being seen at the TCP layer.
Agents remove the constraint the web relied on
Cory Doctorow’s enshittification theory says platforms degrade when the constraints on them erode: competition, regulation, interoperability, and worker power. The open web leaned hardest on interoperability, specifically the adversarial kind. The user agent ran on your machine and you could change it, with blockers, reader mode, user stylesheets, alternate browsers, scrapers. Every time a provider pulled something, users had a counter within a few years.
Hosted agent apps move the user agent onto the vendor’s server. You can’t install an extension inside someone else’s chat window, so that end-run is gone.
Doctorow’s stages fit too. Stage one is now: cheap or free, user-aligned, “your agent.” Stage two is already showing. OpenAI has sold ads under ChatGPT answers since February, Google places sponsored results inside AI Mode’s answers, and checkout partnerships and tools ranked by relationship are following. Stage three lands on the providers who integrated most deeply.
Chrome shows the limit
A third party owning the user agent keeps providers honest only while its incentives line up with yours, and Chrome shows what happens when they stop. Chrome blocked popups, pushed the web to HTTPS, and in 2018 filtered the most intrusive ad formats. Then it delayed and finally abandoned third-party cookie deprecation while Safari and Firefox had blocked them for years, cut the capability ad blockers depend on with Manifest V3, and tried to move ad targeting into the browser itself.
What capped how far Chrome could bend was the standard, plus other browsers rendering the same page. Google could weaken your ad blocker. It couldn’t rewrite a competitor’s site or take a percentage of a checkout inside the viewport. The model companies have no such cap, because the page they render is one they wrote. Chrome’s slide is the failure case, not a ceiling to settle for, and the hosted clients from OpenAI and Anthropic are already further down it than Chrome ever got, because there’s no standard underneath them to slow the descent. The target is the balance the web had. The client works for the user, and the cap on the vendor comes from other clients rendering the same provider the same way.
Competition between agent companies will not stop it
Mathias puts his hope in competition between agent companies. Competition protects the web only when the competitors render one public format. Netscape, Internet Explorer, Firefox and Chrome competed that way, and the page stayed the page through all of it. iOS and Android competed on proprietary surfaces for fifteen years and gave us two app stores with the same cut. Agent companies are competing the second way. Agent companies compete on model quality and on the interface, and the web is raw material they compete to consume better. The Agent Experience push, making your data easy for agents to reach, is table stakes, and it deepens the dependency. It’s stage two building the conditions for stage three, and the sites easiest to consume are the first to disappear into the summary.
Decentralized infrastructure moves the problem
I’ve been pointing people at Project NANDA at the MIT Media Lab. It and efforts like it are building open registries, identity, and discovery for agents, which is network-layer work, and it matters. If every agent in an open registry gets reached through one of three closed client apps, though, the registry is open and the platform is closed. The problem moved from discovery to the client. Fund the infrastructure, and don’t mistake it for the layer that decides who owns the web.
Reversing the pull means restoring the constraints
Interoperability is the one to restore first, on both the provider side and the client side.
On the provider side, sites render their own surface inside the agent. The web stayed open because a page rendered on its own terms in any browser, and the equivalent is a standard that lets a provider render its own interface inside any agent client. Early work exists, MCP Apps among them. This is where I’d put my energy. A provider that shows up inside an agent only as text the model paraphrases has become a database with a brand nobody sees. Rendering your own surface fixes how you appear once you’re called. Whether you’re called at all, and in what order, is a decision the client makes, which is why the client has to be yours.
On the client side, the client separates from the model. The client is the harness: the tools it’s wired to, the context and memory it keeps, the permissions it enforces, the extensions you add, and the surface that shows the result. That’s the browser plus everything you bolted onto it, and it belongs on your side. The model is the intelligence the harness calls, and it should be as swappable as a search engine is in a browser. Selection then lives in the harness. Which providers are wired in, and how their results rank, is a setting you own rather than a judgment the model makes for its vendor. This is where the browser analogy runs thin and why the separation matters. A browser never owned what was in the viewport, so a closed client was harmless. An agent client bundled with its vendor’s model owns the viewport and the intelligence behind it, and that pairing is what the separation breaks.
The closest thing to that today is the open source coding agent, and the source license is the least of it. Tools like OpenCode, Cline and Goose already let you point one client at any model, keep your tools and context on your own machine, and switch vendors without losing your setup. They’re built for developers, though, and a client like that has to reach people who will never open a terminal.
That takes distribution, and the company best placed to provide it for a broad consumer audience is Apple, at least inside its own ecosystem. Apple’s record on open ecosystems is poor, and the App Store section above is the evidence. It also has the hardware to run capable local models already in a very large number of hands, it hasn’t bet the company on a frontier model of its own, and it has partnered for intelligence instead, with OpenAI first and Google after. That leaves Apple free to be model agnostic in a way none of the labs can be. The shape I’d want is a new dedicated app rather than another pass at Siri: a first-party LM Studio for regular people, with your models, tools and history syncing through iCloud so the same agent shows up on your phone, your desktop and the web. Apple’s incentive as a hardware seller lines up with that. Its incentive as an App Store operator pulls the other way, and which one wins inside Apple decides whether this happens. That’s the risk in this whole path. If the store instinct wins, the consumer client falls to the browser vendors, and none of them has shipped one.
Whoever ships the client also needs a business on the other side of it, and Netscape is the warning rather than the model. It gave the browser away and sold server software, and that didn’t save it once a competitor bundled a free browser with the operating system. The trade that lasted is Apple’s. It sells the hardware and gives the client away. Hosting companies have the provider-side version of the same trade, since whoever helps a site render its own surface inside an agent gets paid by the site. Both of those businesses exist today, and neither is funding an agent client. That’s the gap. Hardware makers and hosting companies belong in this fight far more than they are, and more than the model companies do, because an open client threatens nothing they sell.
Competition has to happen between clients, and it has to mean more than a choice of models. Five models behind one chat window is one platform. An Apple client, the open source ones, and whatever the browser vendors ship, all rendering the same provider the same way, is competition that protects the web.
Regulation is the backstop: interoperability mandates and disclosure of paid placement inside answers. It shows up slowly and follows the other two.
And the version built on a public standard has to win on convenience. The web beat everything before it with one address, no install, and the same page everywhere, and openness rode along as a side effect. An open agent surface has to be the easier choice, or the default stays with whoever ships the chat window.
The default is set
Left alone, the standards persist as plumbing and the companies that own the conversation own the web, with no user-side counter this time. Protocols underneath will keep improving and won’t change that. The place to push is the interface layer.
If you build sites, ship agent access and insist on rendering your own surface. If you build infrastructure, the fight is at the client, and it’s early enough to get in.
Netscape shipped a client that owned nothing in the page. Who ships it this time?