Six days. That is the gap between the moment Amazon quietly revised a support page and the moment the change it describes starts spending advertiser money in places no advertiser selected. On August 4, 2026, Amazon Ads updated the article titled Understand Sponsored Products off-Amazon advertising, adding creators to the list of destinations where the format can run, and an accompanying notice to advertisers set a start date of August 10, 2026. Existing campaigns are enrolled by default, at their existing bids and budgets, and the notice states that no advertiser action is required.

The change is small in word count and large in consequence, and it arrived on a day when the same question kept surfacing in different forms across the trade press: who decides where a brand actually appears? On Amazon, from next week, part of that answer belongs to creators. On Android handsets, DoubleVerify researchers documented a class of application that answers it by waiting for a phone call to end. On the App Store, Pavel Durov described an answer supplied by an anonymous report and executed before anyone at Telegram was contacted. Inside demand-side platforms, StackAdapt proposed that agents supply the answer, and disclosed a usage pattern narrow enough to complicate the pitch.

Four stories, one structural theme. Placement authority is migrating outward, and the reporting layers that would let a buyer audit the result are lagging behind the mechanisms that produce it.

Amazon adds creators to offsite Sponsored Products

The documentation change is short and operationally specific. Sponsored Products campaigns extend beyond Amazon to premium sites, apps, and creators, the support page now states. Until August 4, the offsite inventory Amazon described in its own documentation consisted of publisher properties and applications only.

The wider notice reached advertisers by email, and two practitioners published the same text on LinkedIn. Campaigns may begin appearing off Amazon through creators enrolled in the Amazon Influencer Program from 10 August. Current settings, bids and budgets apply.

Four mechanics govern the layer. Amazon recommends products to creators judged aligned with a brand, weighing relevance and engagement history. Creators self-select which of those products to feature in product reviews, editorial content and buying guides. Advertisers can exclude specific creators. Clicks route the shopper to the product detail page on Amazon, and standard Sponsored Products billing applies at cost per click.

Read that sequence carefully and the direction of the selection becomes clear. The system nominates. The creator chooses. The advertiser can only subtract. Nothing in the published notice describes an account-level switch that removes creator inventory in full, and nothing describes what creators are paid.

Geography is uneven. Offsite placements are open to advertisers in Brazil, Canada, India, Mexico, the United States, the Middle East, North Africa and Turkey, and select European Union countries. The United Kingdom does not appear, which sits oddly beside the British spelling used in the advertiser notice itself. One commenter, Jon Derkits, raised precisely that point beneath the LinkedIn thread. Amazon has published no explanation.

Bidding rules carry over with two exceptions that matter to anyone reconciling a placement report. A maximum bid applies to every click, on or off Amazon. Bid adjustments for Top of Search and Product Pages do not apply to offsite placements. Dynamic bidding and other strategies do. Every click counts against the campaign budget, and cost per click never exceeds the maximum bid, regardless of how the publisher on the other end is compensated.

Two campaign-level settings sit under a section labelled Settings for ads served off Amazon. Increase reach is the default. Limit off-Amazon spend restricts delivery offsite, which the page notes may reduce impressions and sales opportunities. Either can be changed mid-flight. Managing that toggle across a large account became practical two months ago, when Amazon added an Off-Amazon ad serving column to Sponsored Products bulksheets on June 8, 2026 for United States advertisers. That column now governs a materially different inventory mix than it did in June.

Destaney Wishon, chief executive of btr media, read the release as a beginning rather than a finished product, describing a self-serve layer rather than negotiated creator deals. Jon Elder, an Amazon and Walmart advisor, took a blunter view and asserted that Gold and Platinum tier creators are accepting recommended products because Amazon is offering guaranteed earnings per click. That compensation claim appears in neither the notice nor the support page.

The search terms nobody typed

The most technically consequential paragraph sits in the limitations section, and it has nothing to do with reach.

When a Sponsored Products ad appears in an offsite placement carrying no search context, described on the page as social sites, Amazon will infer and supply a search term with customer context that best matches the advertised product. Those inferred keywords qualify for negative targeting.

The practical effect is a search term report populated with queries no shopper ever entered. They are system-generated descriptors attached to a browsing impression, surfaced in reporting and available as negative targets. Amazon further states that certain campaign controls are unavailable for offsite placements without listing which ones.

That inference layer, more than the creator layer, is what separates this inventory from the search placements funded out of the same budget line. Elder put the behavioural difference plainly, describing offsite traffic as contextual browsing rather than the high-intent shopper typing a product name into the search bar.

Reporting exists in three places. The Sponsored Products Placement Report sits in Campaign manager under Measuring and Reporting. The Amazon Ads API exposes the same view through the reporting endpoint using the Placement Classification metric. Console reports carry MRC-accredited filter settings. On safety, Amazon states that it automatically reviews and blocks unsafe third-party sites and apps, and that deny list preferences can exclude specific properties. Whether individual creator accounts are addressable through that same deny list, or only through the creator exclusion in the notice, is unspecified.

For campaigns serving in the European Union, a pricing transparency report covering advertiser and publisher fees is available under Digital Markets Act compliance, and the page notes that third-party publishers may receive additional funds from Amazon for offsite placements. A payment above the auction clearing price, disclosed inside a regulatory artefact rather than the product documentation, is an unusual place to put a material fact. Amazon introduced pricing transparency reporting for its demand-side platform in March 2024 under the same legislation.

Why the surface change matters more than the reach

Offsite Sponsored Products is not new. Amazon extended the format to apps and websites including Pinterest, BuzzFeed, Hearst Newspapers, Raptive and Ziff Davis titles in October 2023, on the same automatic-participation basis. What changes next week is the character of the surface. Publisher inventory is contextual and editorial. Creator content is personal, and an endorsement embedded in a product review carries a different signal than a display unit beside an article.

The commercial stakes are considerable. Amazon reported advertising services revenue of $19.8 billion for the second quarter of 2026, up 26% year over year, with chief executive Andy Jassy naming Sponsored Products as the largest offering and a key growth driver. AdExchanger put the same quarter against the prior year figure of $15.7 billion. Any change to the supply side of that format touches the revenue line doing most of the work.

Amazon's record in social commerce also frames the move. Amazon Posts, the brand-content feed that ran on product pages, reached complete service shutdown on July 31, 2025. Wishon referenced the closure of Inspire, the short-form video surface, and characterised Creator Connections as slow moving. The Influencer Program route avoids the flaw that sank both, since it places advertiser products inside content that already holds an audience rather than asking shoppers to visit somewhere new.

Measurement is where the exposure concentrates. Attribution for offsite conversions is structurally harder than for onsite clicks, and retail media buyers have been saying for some time that inconsistency is the binding constraint on further investment. IAB Australia found inconsistent metrics across networks to be the largest obstacle to confident spendingeven while buyers raised budgets. Creator placements add a second layer: top-of-funnel traffic, inferred rather than observed queries, and a shared budget with high-intent search clicks.

Elsewhere, brands are handing creators the pen voluntarily

The Amazon mechanism arrived in the same 48 hours as reporting on a broader shift in how brands and creators divide creative authority, and the contrast is instructive.

Digiday reported on August 3 that brands are moving creators out of the media-buy category and into the creative process, running concepts past them as consultants and, in some cases, adjusting beta products on their feedback. Thomas Markland, founder and chief executive at HYDP, framed it as an evolution in respecting creator judgement. PepsiCo's Katelyn Meola, director of flavored sparkling beverages, described bubly bringing a creative thought starter to a creator and co-building from there, having sought out Erin Miller for a presence that could become part of the campaign rather than carry it.

The failure mode is well documented. Piet Southey, managing director at Billion Dollar Boy, warned that an overly rigid ask produces poor engagement because audiences detect content that is not real. Olive oil brand Kosterina learned it directly. Founder and chief executive Katerina Mountanos described unsuccessful posts in which the influencer did exactly what the brand asked, and the in-house team is now less prescriptive with briefs. United States spend on influencer marketing is forecast to grow 15.7% in 2026 and reach $13.7 billion by 2027 on eMarketer numbers.

That is a negotiated transfer of creative control, with longer partnerships and consulting arrangements attached. Amazon's version is a systems transfer: the creator picks from an algorithmically generated shortlist, the advertiser retains an exclusion control, and neither party negotiates the brief because there is no brief.

The AdExchanger roundup on August 4 placed both threads against a third, noting that agency holding companies short of traditional consolidation targets are buying capability rather than agencies. Adweek reported that the major players are looking beyond advertising and media for growth, with Publicis the most visible case after a run of acquisitions stretching from Epsilon to retail media and ecommerce analytics. Influencer and creator marketing is now one of the larger add-on categories, illustrated by Accenture Song's acquisition of Whalar in June. Others are buying agentic infrastructure, or sports and sponsorship capability. The common thread is that the era of buying more agencies is closing, and the new game is bolting on whatever makes the existing model harder to dislodge.

DoubleVerify documents ads that fire when a call ends

The second answer to the placement question is considerably less welcome. DoubleVerify engineers published research on July 13, 2026 describing a class of Android application that waits for a phone call to finish and then takes over the screen with an advertisement, a pattern the company named AfterCall ads. The DV Fraud Lab uncovers dozens of these applications every month, and collectively they account for hundreds of millions of impressions.

The mechanism uses three ordinary Android features, none of them a vulnerability. The pivot is SYSTEM_ALERT_WINDOW, exposed to users as the Display over other apps setting, which cannot be granted through a standard in-application dialogue and instead requires a redirect into Settings. Fraudulent developers work around that friction by manipulating the order in which permissions are requested, presenting a plausible justification during onboarding or blocking the application interface until the permission is granted. The post attributes the technique to deception and a lack of user knowledge rather than technical sophistication.

Next comes a BroadcastReceiver registered for the telephony intents that fire when call state changes. When a call ends, the state changes to IDLE, and the application uses that signal to display an ad. The manifest DoubleVerify reproduced sets receiver priority to 998, an unusually high value that pushes it ahead of other listeners, and registers for device startup, application updates and power connection events so the process stays resident in memory and captures more end-of-call moments.

Two evasion techniques sit in the activity that renders the ad. It removes itself from the recent applications list once the advertisement displays, cutting the trail a user would follow to identify the source, which reduces uninstalls and therefore raises revenue. And the icon shown in the corner of the ad screen imitates everyday utilities such as a clock, a notes application or a calendar.

Detection fails on three fronts. Static signatures cannot work because each developer writes a different variation with no shared package or class names. Behavioural signatures sweep up legitimate caller identification applications, which listen for exactly the same events and have an obvious reason to display something when a call ends. User reporting collapses because a user who cannot attribute the behaviour cannot report it.

Here is the part that should trouble anyone reading a campaign dashboard. AfterCall impressions pass the metrics most campaigns are graded on. The ad renders at full size on a real device operated by a real person who has just finished a real call. Invalid traffic filters find nothing. Viewability registers a success. DoubleVerify's own first-quarter 2026 benchmarks put mobile application display viewability at 82%, the highest of any device category, which illustrates how little that number says about whether an impression was welcome.

The failure is contextual rather than technical, which places it beside the made-for-advertising problem on the open web. IAS research published in July 2026 found mobile web display carrying an MFA rate four times the baseline. AppsFlyer reported in June 2026 that organic traffic now accounts for 52% of fraudulent mobile installs across 106.4 billion installs and 246,000 applications, undermining the baseline most mobile teams measure everything else against. Two days before the AfterCall post, HUMAN Security's Satori team disrupted NewsJunkie, a connected television scheme generating close to two billion invalid bid requests per day per seller.

Platform enforcement has aimed at this behaviour before. Google described in August 2025 how Gemini-based systems mimic user behaviour to detect hidden and disruptive out-of-context advertisements, reporting a 40% reduction in deceptive ads and removing 352 applications tied to one operation during 2025. AfterCall applications are still clearing pre-installation scanning. One caveat belongs on the record: DoubleVerify states that its own detection identifies the scheme across all observed variations, a claim no third party has verified, and the company faces a shareholder derivative complaint filed in December 2025 over representations about its bot detection technology.

Apple pulled Telegram overnight on a third-party report

The third answer came from Telegram's founder. Durov said on August 4 that Apple removed the messaging application from the App Store overnight after an attacker planted illegal material inside a public group chat, and that the listing returned within hours. His account, published on X at 7:02 PM and carrying 1.1 million views, states that Apple acted before contacting the company. Apple has issued no public statement.

The method is the substantive disclosure. Because Telegram strips illegal content from public groups quickly, the attacker edited an old message inside an active group chat to insert AI-modified material. The content therefore sat outside the live view, invisible to the group's own members, who could neither see it nor report it. That is an attack aimed squarely at the community reporting layer, which only activates when someone encounters the material.

Durov identified the perpetrator as a takedown extortionist, describing operators who demand payment from group owners and, when refused, use automated accounts to plant illegal content and report it directly to Apple. Automation is what makes the economics work. Reddit removes roughly 100,000 bad bots daily on figures published in March 2026, which indicates the volume of disposable accounts available for a plant-and-report operation.

Three exposures follow for media buyers, and none require taking Durov's prevalence claims at face value. Distribution is a single point of failure for paid acquisition: an install campaign loses its destination the moment the listing does, and a removal window measured in hours sits inside a normal optimisation cycle. The precedent is established rather than hypothetical. Apple removed the rewarded-engagement application Freecash on April 13, 2026 without prior notice, disrupting a user acquisition channel publisher Almedia had built to 60 million registered accounts, and pulled the music application Musi on September 24, 2024 after intellectual property complaints from YouTube, with 66 million downloads recorded before removal.

The App Store is also an ad channel in its own right, having begun running additional advertisements in search results from March 3, 2026, starting in the United Kingdom. Search advertising against a delisted application buys traffic to nothing. And Telegram sells advertising inside public broadcast channels, a business that helped the platform reach profitability on revenue of one billion dollars announced in December 2024. An attack engineered to insert illegal content into an active public group, and to keep it invisible to that group, is a brand safety failure mode channel-level verification was never built to catch.

Weaponised reporting is documented well outside the App Store. In Germany, businesses have systematically deleted critical reviews by filing mass complaints through Digital Services Act notice-and-action mechanisms, exploiting the same asymmetry Durov describes, where removing flagged content costs less than contesting it. The timing also lands inside a year of expanding classification duties for applications hosting user content: Apple added social media questions to the App Store Connect age rating questionnaire on July 9, 2026, mandatory from September.

StackAdapt puts the workflow inside the agent

The fourth answer is the one the industry has been rehearsing all year. StackAdapt introduced Ivy Studio on July 28, 2026, a natural-language hub folding planning, forecasting, analysis, optimization and execution into a single agent-driven surface inside its demand-side platform. Two disclosed numbers measure different things and deserve separating.

StackAdapt employees run more than 15,000 AI-assisted workflows each week through Ivy, the underlying engine. That is internal usage by the vendor's own staff, not customer adoption, though it is harder to manufacture than a customer count. Separately, close to 70% of Ivy Studio activity concentrates in the top 20 workflows. The company presents that as adoption strength for the tasks that matter most. It equally describes a narrow surface, weighted toward repeatable reporting and diagnostics rather than open-ended strategic work. Kelsey Carey of Colour Media, the sole named customer, described pulling routine metric reports across multiple campaigns into unified outputs, which aligns with the concentration figure rather than contradicting it.

Ivy launched thirteen months earlier, on July 9, 2025, after roughly 1,700 in-platform messages in the preceding thirty days. The new release also discloses that StackAdapt uses OpenAI language models for bespoke advertising capabilities, without specifying which models, which components run on them, or how those calls interact with client campaign data.

One architectural difference separates this from much of the surrounding activity. Most agent infrastructure built over the past eighteen months runs on the Model Context Protocol. Amazon Ads moved its own MCP server into open beta on February 2, 2026, letting external agents reach its advertising APIs through one integration, and Adform opened 29 read-only skills against its FLOW DSP in July 2026. Ivy Studio references none of that. It is built inside the platform, betting on domain grounding rather than connectivity, which is a defensible position and a closed one.

Adoption evidence keeps running behind adoption enthusiasm. Taboola research across 200 marketing leaders found that 76% of senior performance marketers report meaningful improvements from agentic campaign tools while those benefits concentrate inside search and social, with adoption at 98% for Performance Max and Advantage+ against 80% for the open web. StackAdapt published no pricing, no general availability date, no geographic scope and no customer count. Those omissions are the practical limit on what any buyer can verify, and they are common across the category.

Set the four stories side by side and the pattern holds. A creator selects the product, an application selects the moment, a report selects the listing, and an agent selects the action. In each case the mechanism shipped first and the audit trail is still being drafted. Amazon's six-day window between documentation and activation is simply the tightest example.

Also noted