Agents Just Ate Our VAs

By San Eng | September 22, 2026 | East/West AIpha · Edition 17

Here is the number that should reorder your week.

On OpenRouter, where builders actually buy tokens, CNBC's 7 July 2026 investigation found US companies have routed more than 30 percent of their weekly OpenRouter traffic to Chinese models every week since 8 February 2026. That share peaked as high as about 46 percent (up from about 4.5 percent in the first half of 2025 and an 11 percent trailing-twelve-month average in that report). Secondary OpenRouter tallies in the same reporting cluster put Chinese-origin share around 46 percent against US-origin around 36 percent, with DeepSeek (深度求索) the largest single vendor near 18 percent. Treat the peak band as directionally firm. Treat any single decimal as a cut, not gospel. Anthropic remains the largest US-origin vendor in that cluster, around the low-to-mid teens.

Read that again. The East is not catching up. On these rails, the ones builders actually pay for, the East already won the volume game. Everything below follows from that fact. If you allocate capital, the question is not which model wins a leaderboard. It is who owns permission to act inside the graph where work and money already live. OpenRouter is the receipt. Leaderboards are marketing. Token share where builders pay is the tell.

I set up OpenClaw, Kimi Claw, and other personal agents For months I fed them, patched them, and debugged them at midnight so my agent could book a flight I could have booked myself in four minutes. (VA = virtual assistant. Agents just ate them.)

Then the platforms arrived and the tax went toward zero. My own path: Town.com first, then Grok Bot (our agent stack), then Muse when Meta launched it on 8 September 2026, inside the Muse app and inside WhatsApp, each agent in its own Muse Secure VM, asking permission before it sends anything sensitive or touches money. I run that US stack on the road this week, between Seoul, Bangkok, and Fukuoka. The Gemini instance I run inside Workspace absorbed the rest of the jobs the DIY stack used to do.

Distribution ate the DIY. Permission beat cleverness. The agent that lives where you already live wins, because it never asks you to move.

The honest counterargument is privacy: handing an agent your inbox, calendar, and payment rails is Facebook times 1,000. I have weighed it. The market is voting for convenience with a permission prompt attached. That vote is not a free lunch for wrappers.

We are heavy users of this stack, not tourists.

Town.com: we are huge fans of the product. Signup is open (Free tier plus paid). Our issue is the cost structure: credit burn and overage make heavy automation bills hard to predict. Great when it works. Expensive when routines run hot.

Grok Bot: daily driver for research, drafting, and ops glue inside our WorkOptional agent stack. Lives where we already work.

Muse: Meta's personal agent after 8 Sep. Muse Secure VM, WhatsApp-native, Sentinel permission gates. Strong on distribution. Trust and data questions still real.

Kimi Claw: Moonshot's one-click hosted OpenClaw on kimi.com (always-on agent, skills library). Separate from Agent Swarm, which is Kimi's multi-agent capability (product language now up to hundreds of sub-agents). We use both the Claw path and Agent Swarm for East-side research and grind.

Net: DIY OpenClaw taught us the tax. Town.com, Grok Bot, Muse, and Kimi Claw taught us who collects the rent.

My friend May is a Shanghai product lead. She starts a new seat in Q1, which is normal there: Chinese hiring and role starts cluster after Spring Festival, when the year actually opens. Her day shows the winning pattern when the super-app owns the rails.

She starts in the Qwen (千问) app. On 15 January 2026 Alibaba pushed a major agentic upgrade, wiring Taobao (淘宝), Fliggy (飞猪), Amap (高德), and in-chat Alipay (支付宝) payment after explicit confirmation (Chinese press widely called out a 400-plus capability jump; Alibaba's English release stressed the rails, not the headcount). She delegates research to a Kimi Agent Swarm. She pings Yuanbao (元宝) inside WeChat (微信). Her phone runs Zhipu (智谱) AutoGLM-class phone agents, open-sourced in the December 2025 wave, aimed at operating many Chinese apps including WeChat, Taobao, Douyin (抖音), and Meituan (美团).

Now the part Western builders keep missing. WeChat, Alipay, and Meituan have blocked or tightly gated third-party AI agents from logging into the core graph after permission-abuse blowback. The platforms saw the agents coming and closed the door.

There is an old line for this: 皮之不存，毛将焉附. When the skin is gone, where does the hair attach? No permission, no agent. No agent, no business.

That is the whole game in one idiom.

The model is not the moat. Permission is.

The same commandment appears in The Ten Commandments of Investing (WSJ #4 / USA Today): Own Your Space, or you rent permission forever.

If that is your book, subscribe for free at workoptional.ai.

West pattern: chat app + OS + wallet as distribution (WhatsApp / Muse, Grok Bot inside our stack and X-adjacent workflows, Copilot inside Microsoft, Gemini inside Workspace). DIY and wrappers rent the surface.

East pattern: super-app owns chat, pay, and local life (WeChat, Alipay, Meituan). First-party agents (Qwen, Yuanbao, Kimi) ride inside. Third-party agents hit the login wall.

Same lesson both sides: the landlord is the platform. The agent is the tenant.

The migration is already visible in Western builder behavior too. In mid-2026, agent startup Lindy moved 100 percent of its traffic from Anthropic's Claude models to DeepSeek, citing millions in savings within months (CNBC; CEO Flo Crivello). When the agent startups themselves switch, the chat-versus-cost debate is over for a large class of workloads.

^{East/West AIpha Premium membership opens soon. Subscribers hear first.}

Picture the wall from the other side. You point a third-party agent at WeChat to triage supplier messages, and the login dies on contact. No elegant error. Just a door that no longer opens. In Shanghai, everyone already prices this in. The platform is the landlord. The agent is the tenant. The lease can be rewritten overnight.

For a family office, sit with that. Every agent demo you diligence assumes access the platform can revoke on a Tuesday. Ask permission questions before capability questions. Who grants access? What does it cost to keep? What happens to the business when it is gone?

China is not running one agent race. It is running four, each true to its DNA.

Alibaba (阿里巴巴) is aggressive, shipping Qwen straight into commerce where the transaction already lives. Tencent (腾讯) is deliberate: Yuanbao's social agent features have stayed invite-gated; Pony Ma has said WeChat will not build an AI full suite; Hunyuan (混元) agent work has been folded into Yuanbao. Do not call this shipping to 1.4 billion users tomorrow. Moonshot (月之暗面) bets on intelligence density, with Kimi Agent Swarm and Kimi Claw as the proof points. Zhipu open-sources for builders and lets the community carry distribution.

Then Manus (蝴蝶效应 / Butterfly Effect), the cautionary tale with a Beijing ending. A multi-billion Meta acquisition path announced in late 2025. Beijing's NDRC ordered the foreign deal unwound in April 2026, citing export controls and foreign investment rules. By mid-September 2026, reporting (Bloomberg / WSJ / TechCrunch cluster) said Manus was in talks for about $500 million at roughly a $4 billion valuation, with Tencent among names in the chatter and a Hong Kong listing considered. Reported talks, not closed. The product brand stays Manus (Latin for hand). The company is Butterfly Effect.

The lesson travels: in China, the regulator is a co-founder you did not choose, and it has veto rights.

Three positions. Conviction with kill switches named.

First, overweight the rails. Own the Big Tech names shipping agents into surfaces they already control: chat app, OS, payment flow. Counterargument: if agents commoditize into the OS and the payment layer, value accrues to device and transaction owners, not agent brands or model labs. I have weighed it. The rails still win, because the rails collect the toll either way. Kill switch: a real platform shift into a device category incumbents do not control.

Second, respect the East brains. Western decks are still underweight this. OpenRouter is the receipt. Rising token spend is not a short thesis by itself. It is the cost of taxing the graph. Kill switch: Beijing treating agents as critical infrastructure and picking winners by license instead of product. Size China-adjacent exposure like a policy option with no neat expiry.

Third, stay cautious on the wrapper class.

Instinct raised $250 million Series B at a $2.5 billion valuation in August 2026 (WSJ / TechCrunch; Index and Benchmark co-led; about $350 million total capital). Weeks later, The Information reported talks to raise about $1 billion at about $10 billion. Reported talks, not closed. A fourfold markup in weeks is not a moat. It is a frenzy. Product is hot. Permission story is messier: trust friction in public reporting, users past 100k while still uncharged in many accounts, and Meta shipping free Muse into the same segment on 8 Sep.

Town.com raised $55 million from a16z in June (Forerunner and others in the round). Later reporting put talks around a $1 billion valuation. Index was set to lead a later round; Instinct complained about conflict; Forerunner and Menlo stepped in. Reported, not closed. We like the product. We dislike unpredictable credit burn at scale. When your lead gets fired by your competitor, you are buying a distribution story, not a fortress.

Kill switch for this whole leg: any wrapper can win the demo and still lose the permission.

East/West AIpha already has a small track record. What worked: sticky East/West capital frames (bubble-tea distribution, Nobody Trusts China's AI, Apple running Qwen). What went quieter: pure IPO mechanics without a permission or capital punch (DeepSeek going public), and founder lore without an allocator ask (Kimi). This issue is built like the ones that traveled: receipt first, moat second, portfolio third.

Score every agent startup on five lines:

Three diligence questions. Numbers, not adjectives.

What is the action completion rate?

What does permission churn look like after week four?

What happens to retention when a free platform agent ships the same feature?

If the founder cannot answer all three with numbers, pass.

Directional memo, not a trade ticket. There is no clean public vehicle for DeepSeek.

The sleeve below is illustrative and hypothetical only. It is not a recommendation to buy or sell any security.

Worked sleeve on a hypothetical $10 million agent book:

Revisit every quarter on the five-line scorecard.

Keep: anything built on a proprietary graph no platform can copy.

Migrate: every virtual-assistant workflow onto platform agents this quarter.

Eliminate: brittle DIY integrations that need midnight debugging.

We eat our own cooking: Grok Bot and Kimi run research and the Beehiiv pipeline; the Muse path is working toward ops; Town.com stays in the mix with eyes open on credit burn. Lean means killing DIY. Native means commanding agents where you already live.

Own the surface, or rent permission forever.

The agents ate the virtual assistants because they owned the surface the work happened on. Your portfolio companies face the same choice. So do you.

Read Commandment 2 in The Ten Commandments of Investing at https://a.co/d/331TXi6. Then join East/West AIpha if this landed: https://www.workoptional.ai/.

^{East/West AIpha Premium membership opens soon. Subscribers hear first.}

This list is for builders and capital allocators who want the receipt, not the leaderboard.

Forward this to one allocator still wiring OpenClaw.

For informational and educational purposes only. Not financial, investment, legal, or tax advice. Hypothetical portfolios and sleeves are for discussion only and are not recommendations to buy or sell any security. WorkOptional.ai and affiliates may hold positions mentioned. Past performance is not indicative of future results. Funding rounds marked reported are not confirmed closed. All third-party names and marks are the property of their respective owners.