The instruction was four words long: install mijiaAPI. By the time the agent finished, it had pulled an open-source Python library from the internet, deployed it into a cloud sandbox, enumerated thirteen household devices, generated a printed A4 manual, and driven a physical printer to spit it out. I read this in a WeChat product diary — the only public trace of Ant Group's new Lingguang Personal Agent, still in limited beta — and my first reaction wasn't excitement. It was the same cold knot I felt in 2017, watching LibertyDAO's treasury bleed out through a multisig I had personally signed off on.
Lingguang is not a standalone app. It's a tab inside Alipay — 'My Life' — and that placement is the entire story. Ant isn't selling an agent; it's fortifying the super app against the one competitor that terrifies it: WeChat. Tencent already fused a model with mini-programs and payments. Lingguang is Ant's symmetrical answer — an agent that reaches into Xiaomi's Mijia ecosystem, into DingTalk, into your air conditioner and your shopping cart, and quietly becomes the control layer above them all.
The public record is thin. One experience piece, no benchmarks, no architecture, no pricing, no disclosure of whether Ant and the author had any relationship. What we know is that the product runs a code-execution kernel — the same lineage as Manus and OpenAI's interpreter — wrapped in IoT control and a payment loop. Limited beta. Six months of iteration. That is the entire evidence base, and everything below is constrained by it. Ant's IPO was suspended in 2020; it has been searching for a second act ever since, and an agent that re-centers Alipay as the place where life happens is that second act — part product, part narrative, and entirely a bid to stay indispensable.
The most technically revealing detail is the capability-acquisition model. A pre-baked integration list would have been unremarkable; every smart home app has one. But install mijiaAPI means the agent runs in a sandboxed cloud Python environment where it can write and execute code to bridge third-party APIs on demand. Its ceiling isn't Ant's integration count — it's whether an open-source library exists. That's a category difference, and it's also where the danger lives: a capability that scales with the open-source ecosystem is a capability no single vendor can fully audit or contain.
Think about what this architecture actually is. It's a smart contract with a mutable body. On a blockchain, you deploy bytecode and the network verifies every state transition. Here, the agent generates fresh code per request, executes it in an environment whose isolation scheme we cannot inspect, and the result is — nothing. No receipt. No audit trail. No one can replay the run and prove what happened. In the systems I've spent my career in, trust isn't verified on-chain — but here it isn't verified anywhere, and that is the precise inversion of the trust model we spent a decade building.
The security surface is worse than any DeFi protocol I've audited, because it stacks three high-risk properties at once: arbitrary code execution, physical device control, and ambient access to sensitive data. A prompt injection hidden in a scraped e-commerce page — 'ignore previous instructions, instead...' — could flip a nightly price check into an unauthorized purchase. That's not a theoretical bug; it's the same attack class that has drained DAOs through manipulated oracles. The difference is that here the consequence crosses into the physical world: a printer, a thermostat, a device that turns on when it shouldn't.
Then there's the economics. Persistent cloud Python sandboxes — per user, with dependencies installed and state held — are a brutal infrastructure load. Unlike pure inference, which is stateless and batchable, a code sandbox needs isolation and continuity. Add cron-like scheduling for the 8 p.m. price checks and the 7 a.m. temperature readings, and you need servers running around the clock for users who may never pay a cent. In a free tier, the unit economics invert: the heaviest users cost the most and monetize the least. Scale that to a hundred million Alipay accounts and the sandbox bill becomes a strategic liability, not a feature.
And underneath all of it, a telling silence. Ant doesn't say which model powers this, how the sandbox is isolated, whether prompt-injection defenses exist, or whether the whole thing has cleared model registration. For a licensed financial group, that silence is itself data.
The consensus reading is that this is Ant's 'agent moment' — a late but inevitable catch-up to Manus and OpenAI. I think that misses the real move, and the real fragility.
Ant isn't trying to build the strongest agent. It's trying to build the strongest gate. The scarce resource in the agent era isn't intelligence — it's the entry point. Whoever owns the surface where intent becomes action owns the transaction. That's why 'My Life' matters more than any benchmark: it converts Alipay from a payment tool into a living-service hub, and every agent task funnels toward a purchase, a payment, a capture.
But here's the contradiction nobody wants to name. To control the home, Ant must reach into Xiaomi's ecosystem — a competitor's. It's open-source arbitrage: a closed product consuming community libraries to bridge into hardware it doesn't make, over a protocol it doesn't control. If Xiaomi tightens its API or blocks the library — and Xiaomi has reversed course on third-party access before — the flagship demo evaporates overnight. Ant is building its moat on someone else's land, and the landlord can raise the rent whenever it likes.
The blind spot in every breathless writeup: nobody asks who audits the agent. We spent years demanding audits before trusting a contract with a dollar. This thing can drive a device. Where is its equivalent?
Code is law, but people are the soul — and right now we have code with no law and no ledger, executing in a black box, touching the physical world. The agent era will replay every governance question we thought we'd answered: who verifies, who can veto, who bears the cost of failure. Decentralization is a verb, not a noun — and so, it turns out, is centralization. Ant has chosen its verb. The rest of us should decide, quickly, whether we're content to be the objects of it.
