01 — What happened
Two things happened in the same fortnight, pointing in opposite directions.
On 28 September, Shopify extended WebMCP support to checkout — including Shop Pay — for all eligible merchants. Browser-based AI agents can now do more than search and fill a cart. Three new tools — get_checkout, update_checkout and complete_checkout — let an agent read the checkout screen, change the delivery address or option, and submit the order with the buyer’s authorisation, without screenshots or page scraping. Shopify’s Gil Greenberg put the reasoning plainly: “Shopping with an agent shouldn’t feel like watching paint dry.” It sits on top of Shopify’s Universal Commerce Protocol, and Meta’s Muse and Instinct already hold direct partnerships with Shopify.
The default matters as much as the capability. Shopify’s own documentation states that agentic storefronts are “automatically activated for eligible merchants”, with no apps to install. Merchants can turn direct checkout on or off per channel in admin. Which is to say: the switch exists, and somebody has to go and look at it.
Running the other way: on the night of Sunday 20 September, Amazon cut Meta’s Muse off from Amazon.com. Shoppers saw a popup: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.”
On 6 October, TechCrunch published a survey of how wide the refusal now runs. Delta said it has no partnership or integration enabling a third-party AI agent to shop for or book its flights on a customer’s behalf. United’s terms forbid “any robot, spider, other automatic device, or manual process to monitor or copy this website”. Yelp does not permit non-human traffic unless the agent has paid through its data licensing programme. eBay, Zillow, Pizza Hut and Adidas were also reported restricting or blocking agents. A change to Cloudflare’s crawler defaults on 15 September lets site owners block AI training while still permitting other bots.
Then the detail that should hold every owner’s attention. Walmart is an official Muse partner — and agents still get stopped there. The reported cause is a button that has to be clicked to verify the visitor is human. That is not a policy on agentic commerce. That is a bot check doing exactly what it was installed to do.
02 — Why it matters
Until now, “should we sell to AI agents?” has been a strategy question that nobody had to answer. In the past fortnight it quietly stopped being a strategy question and became a configuration question.
That is a different kind of problem, because configuration questions do not wait for a decision. They get answered by defaults, by a platform’s roadmap, and by bot-protection rules someone installed years ago that nobody has opened since.
There are now two ways to get this wrong, and they are not symmetrical. If you sell on a mainstream commerce platform, you may already be selling to agents without having decided to, and your exposure is operational — wrong orders, returns, disputes, support load. If you run your own site, or sell services rather than products, you may already be turning agent-borne customers away without having decided to. There is no invoice for that and no line in any report. A refused agent looks identical to a visitor who never arrived.
Meta’s framing is self-serving but hard to argue with: “Turning away a personal agent means turning away the customer behind it.”
Eighteen days ago we wrote that discovery was the live channel and checkout was still yours. That changed faster than we expected — not because consumer trust moved, but because a platform flipped a default.
03 — The economics
Blocking costs nothing to do and nothing to measure. That is why it is happening by accident. A human-verification wall produces no error in your analytics, no abandoned-cart email, no complaint. The customer behind the agent does not ring to say their software could not get through. The cost is invisible, which in practice means it is treated as zero.
Accepting is not free. Wrong variants, addresses the buyer did not check, higher return rates, more disputes, more support load.
But the comparison is usually mis-stated. The question is not “is an agent order as good as a normal order?” It is “is an agent order better than no order?” If the demand is incremental — someone who would otherwise have bought from a competitor whose checkout answered — a higher return rate is a cost of sale, not a loss. The arithmetic only flips when the agent’s order substitutes for one you would have won anyway.
Which is why Amazon’s posture is the wrong one to copy. Amazon can refuse an agent because it owns the demand; the customer comes back through the app, so the agent adds risk and subtracts nothing. Almost no other business is in that position. If your customers reach you by searching, comparing and choosing, you are a candidate, not a destination — and a candidate that cannot be transacted with is dropped from the shortlist. Yelp shows a third model, and it is narrow: charging agents for access works only when your data is the product.
For service businesses the exposure is smaller and the fix is cheaper. Agents are not yet commissioning a fit-out; they are assembling shortlists and filling in enquiry forms. Take an illustrative case: a service business with 300 website enquiries a month, a tenth of whom now begin their research inside an assistant. Today they still press Submit themselves, so nothing breaks. The breakage begins the first time the agent presses it for them — onto the same form, behind the same bot check. Cheap to fix now; expensive to diagnose later from a flat enquiry line.
04 — What businesses should do
1. Find the switch you did not know you had. If you sell on Shopify, open admin, go to your sales channels and read the agentic settings per channel: what is on, for which channels, and whether direct checkout is enabled. Decide it deliberately. Thirty minutes.
2. Test your own site with an agent, this week. Ask a consumer AI assistant to buy something or submit an enquiry on your site, and watch where it stops. Most businesses find one of three things: a human-verification wall, a field the agent cannot interpret, or a checkout step requiring an account. All three are fixable and none is an AI project.
3. Read your bot rules as a commercial document, not a security one. Whoever manages your CDN or web application firewall is currently setting your policy on a sales channel. Ask them which categories of automated traffic are blocked, and whether well-behaved consumer agents are among them. Cloudflare’s 15 September change exists because that distinction — training crawler versus agent acting for a customer — is now worth drawing. It is the same shift from capability to access that made permissions the real constraint on AI automation, arriving this time on the revenue side.
4. If you turn agent checkout on, instrument it first. Tag those orders at source so you can compare return rate, order value and dispute rate against the rest. Without that you will be arguing about agentic commerce on anecdote within a quarter — ordinary CRM and reporting discipline, applied early.
5. Decide your returns position before the first awkward case. Not whether to accept agent orders, but whether an order placed by software gets the same returns treatment as one placed by a person. Otherwise the first case sets the precedent for you.
05 — Where technology fits
For most businesses the honest answer is not AI, and not automation either. It is website configuration — specifically the layer nobody thinks of as the website: the CDN, the firewall, the bot-protection product, the CAPTCHA on the contact form. An unglamorous place for a growth constraint to live, which is why it goes unexamined. The people who manage it are measured on blocking bad traffic, not on admitting good traffic.
Integration matters at the second order. If price lives in a quoting tool, stock in a spreadsheet and availability in somebody’s calendar, the agent reads whichever version is stalest — the familiar cost of disconnected systems meeting a reader with no patience. Fixing it means one source of truth and the plumbing to publish from it: the ordinary work of a connected system.
And a genuine “nothing at all” case. If your orders arrive by phone, repeat account or tender, this whole development is noise for you. Check your contact form is reachable and ignore the rest.
The thing not to do is buy an agentic commerce product. The capability arrived as a platform default and a protocol. What is missing in your business is a decision, not software.
06 — RevenueStack’s take
Our view: the important development is not that an AI agent can press Buy. It is that refusing one has become a demand decision wearing the costume of a security setting — and the people making that decision are not the people answerable for the revenue.
Walmart is the case to study, not Amazon. Walmart signed a partnership with the agent and still stops it at a human-verification button. Not through indecision or strategy, but through the ordinary condition of a business whose web stack holds a rule older than the problem it now faces.
The businesses that benefit over the next year will not be the ones that formed a view on agentic commerce. They will be the ones that went and read their own settings while everyone else debated the trend. Almost every business reading this already has a policy on AI agents. It has simply never read it.
Sources
- Shopify opens checkout to browser-based AI agents — TechCrunch, 2026-09-28
- Shopify Opens Store Checkouts to AI Agents — PYMNTS, 2026-09-28
- Agentic Commerce on Shopify: How It Works (2026) — Shopify, 2026-06-18
- Meta's AI agent has been blocked from using Amazon.com — TechCrunch, 2026-09-21
- The next hurdle for AI agents: getting websites to let them in — TechCrunch, 2026-10-06
