AI Shopping Agents Can Check Out on Your Site. Allow or Block?

In the space of eight days in late September, the two biggest commerce platforms in the world took opposite positions on the same question. Amazon blocked Meta's new shopping agent from its storefront. Shopify gave browser agents the ability to read, edit and submit checkout on every merchant's store, with no setting for merchants to switch on. If you sell online, a decision just got made on your behalf, and it is worth knowing which one.

The short answer

Agent access is now a platform-level default rather than a merchant choice. Shopify extended its WebMCP tools to checkout on 28 September 2026 and stated they require no merchant configuration, so most Shopify stores can already be checked out by a browser agent. Amazon blocked Meta's Muse agent on 20 September, twelve days after launch. Decide deliberately: allow if your economics are volume-led and your fraud controls are strong, meter if agent traffic is unpriced or unmeasured, block only if your terms, margins or compliance position require it.

What actually changed in September 2026

Three events in the same month turned "AI agents browsing your site" from a forecast into an operating condition.

Date	What happened	Why it matters to you
8 September 2026	Meta launched Muse, a personal agent that opens a browser, fills out forms and completes checkout for the user. Meta announced partnerships with Walmart, GameStop, Sephora, Expedia, OpenTable and Shopify	A general-purpose consumer agent with distribution. Agent traffic stops being a research curiosity and starts arriving from a mainstream app
20 September 2026	Amazon began blocking Muse from its retail site, citing undisclosed browsing, stored credentials and violations of its service terms, and said it had not been given notice or a choice about participating	Establishes that blocking is a legitimate, defensible position, and that "the agent did not identify itself" is the argument retailers are making
28 September 2026	Shopify extended WebMCP support to checkout, including Shop Pay. Agents can call `get_checkout`, `update_checkout`, `complete_checkout` and `navigate_to_storefront`. Shopify stated the tools do not expose a new API and do not require merchant configuration	If you are on Shopify, this is live on your store without you enabling anything

The Shopify line is the one worth re-reading. "Does not require merchant configuration" means there was no opt-in step, no email asking you to confirm, and no setting in your admin that you chose. Shopify also enabled Shop Pay checkout by default for eligible US merchants during September, auto-enrolling them unless they manually opted out. Taken together: a large share of merchants reading this have agent-completable checkout today and have never discussed it internally.

That is not an argument that it is bad. Shopify's design is, on the face of it, the better one for merchants: an agent calling a defined tool that reads structured checkout state is far more reliable than an agent guessing at your DOM from screenshots, and it is far easier to attribute. The problem is only that it happened without a decision.

Allow, meter or block: a decision framework

There is no universal right answer here, because the thing being traded differs by business. An agent purchase is incremental revenue to a commodity retailer and a margin leak to a business whose value is in the assisted sale. Work out which you are first.

Score each of the five factors below from 0 to 2 for your business, then total them.

Factor	Score 0	Score 1	Score 2
Purchase complexity	Considered, configured or consultative; the sale needs a human conversation	Some variants and sizing judgement	Commodity, repeat or replenishment; the buyer already knows what they want
Margin per order	Thin, and heavily dependent on upsell at checkout	Moderate, some upsell dependence	Healthy without upsell, or volume-led
Fraud and chargeback exposure	High-fraud category, or you already run above-average dispute rates	Average	Low-value, low-fraud, or strongly protected by your PSP's tooling
Brand and merchandising dependence	Conversion depends on your photography, story and on-site experience	Mixed	Buyers convert on price, availability and delivery date
Compliance and contractual constraints	Age-restricted, licensed, prescription, or contracts that require a verified human buyer	Some restrictions on some lines	None

8–10: allow. Agent traffic is close to pure incremental demand for you. Make your checkout work well for it and measure it as its own channel.

4–7: meter. Allow agents, but instrument them before you optimise for them, rate-limit them at the edge, and keep human confirmation on the highest-risk steps. This is where most merchants genuinely sit, and it is also the group most likely to have drifted into "allow" by default.

0–3: block or restrict. Your terms of service should say so explicitly, and you need enforcement that does not rely on the agent's good manners. eBay took this route with a revised user agreement announced in January 2026 and effective 20 February, barring buy-for-me agents and any end-to-end flow that places orders without human review.

What we'd do about it

Run the scoring exercise before you touch any configuration, and write the total down somewhere your team can find it. Almost every bad outcome here comes from a merchant who never scored it, allowed agents by inheritance, and then discovered the position six months later through a dispute ratio or a confusing analytics report.

What your controls actually do, and what they do not

The single most common mistake in this area is treating robots.txt as enforcement. It is a published request. The server still has to accept the HTTP request in order to serve the file that asks the client to go away, and compliance is voluntary by design.

It gets more specific than that. For user-initiated fetches, where a person asked their assistant to go and look at a page, OpenAI, Google and Perplexity all state they do not honour robots.txt, on the reasoning that the request originates with a user rather than a crawler. Anthropic is the one major operator that states it respects robots.txt across training, search indexing and user-initiated fetches alike. So a robots.txt block aimed at shopping agents will, for most operators, stop the training crawler and not the agent.

Control	What it genuinely does	What it does not do
`robots.txt` directives	Signals policy to compliant crawlers. Operators expose separate tokens for training, search indexing and user-initiated fetches, so you can control those independently	Enforce anything. Several operators explicitly exempt user-initiated fetches from it
WAF rules and rate limiting	Actually refuses or slows requests at the edge. The only layer in this list with teeth	Distinguish a legitimate agent from a scraper without a reliable identity signal, which is the hard part
Web Bot Auth	A draft IETF protocol that has operators cryptographically sign request headers, giving you verifiable identity rather than a claimed user agent string	Cover operators who have not adopted it. It is a draft, and adoption is partial
Platform settings	Where the real switch lives on hosted platforms. Shopify's agent checkout tools are the current example of a platform-level default	Exist in every case. Shopify stated its WebMCP checkout tools require no merchant configuration
Terms of service	Gives you a stated, enforceable position, which is what Amazon and eBay both leaned on	Technically prevent a single request

The practical read: your terms state the position, your WAF enforces it, and Web Bot Auth is the thing that will eventually make enforcement accurate rather than crude. Until adoption is broad, anyone blocking agents is accepting some false positives on real customers using assistive tooling.

The payments problem nobody mentions in the launch posts

An agent-placed order is processed as card-not-present, and the card networks do not currently extend a liability shift to it. That means the dispute lands with you. Visa and Mastercard have both launched frameworks that let verified agents transact with tokenised credentials and scoped, auditable mandates, which is the route out of this, but the protection follows the framework, not the agent.

So the risk is concentrated in exactly one place: an agent transacting with stored card credentials outside a network framework. That was a substantial part of Amazon's stated objection to Muse, and it is the specific thing to check with your payment provider before you decide you are comfortable.

Three questions for your PSP, in writing:

Do you support a network agent framework yet, and on which card schemes? If yes, agent orders routed through it carry defined liability. If no, every agent order is an unprotected card-not-present transaction on your account.
Can you tag agent-originated transactions in reporting? You cannot manage a dispute rate you cannot segment. If agent orders are invisible in your PSP data, you will discover the pattern through a chargeback review rather than a dashboard.
How does your fraud scoring treat agent behaviour? Agents produce signatures that legacy models read as suspicious: no mouse movement, improbable form-fill speed, device and IP mismatches against the cardholder. Unmanaged, that shows up as declines on good orders rather than as fraud prevented.

The third one has a direct conversion cost, and it is the one most likely to be already happening to you. If your decline rate has drifted upward since the summer without an obvious cause, agent traffic hitting a fraud model that was tuned for humans is a reasonable hypothesis to test.

A ten-point agent-readiness audit

Whether you end up allowing or metering, these are worth checking. None of them takes long, and most reveal something.

Find out whether you are already open. On Shopify, assume agent checkout is live unless you have confirmed otherwise. On custom builds, check what your WAF and bot-management vendor are currently doing with known agent user agents.
Segment agent traffic in analytics. Build the report before you need it. If you cannot see agent sessions separately, every conversion-rate number you look at is now a blend of two populations with very different behaviour.
Check your product data, not your product pages. Agents read structured data. Incomplete or stale price, availability, variant and delivery data in your feed and schema is now a conversion problem, not just an SEO one.
Test checkout without a mouse. Keyboard-only, no hover, no scroll-triggered reveals. An agent cannot use a control that only appears on hover, and neither can a screen-reader user, which is the overlap worth exploiting.
Audit anything behind an interstitial. Cookie walls, age gates, email-capture modals and region selectors are where agent journeys die. Each one is a question about whether you want that gate more than you want the order.
Review your CAPTCHA placement. A CAPTCHA at checkout is now a deliberate choice to refuse agent orders. That is a legitimate choice. Make it knowingly.
Confirm your terms of service say what you mean. If you intend to restrict automated purchasing, the words need to exist before you need to rely on them.
Price your delivery and returns assumptions again. Agent-led buying tends to optimise hard on price and delivery date, which shifts your mix toward your thinnest-margin fulfilment options.
Keep a human confirmation step on high-risk actions. Subscriptions, high-value orders, anything age-restricted. Shopify's own design has complete_checkout submit only after buyer confirmation; mirror that principle wherever you own the flow.
Write down who owns the decision. This currently sits between marketing, engineering and finance, which in practice means nobody. Name a person.

What this means if you do not sell products

The same mechanics reach lead-generation and service sites, just one step earlier. Agents fill forms, request quotes and book appointments, and the gate between a useful enquiry and a worthless one is your form design rather than your checkout. If your sales team has started reporting enquiries that go cold immediately, or contact submissions with oddly complete but generically-worded detail, that is worth investigating as agent traffic before you blame your campaign targeting.

The useful frame is the one that has applied to every technical decision about your site for years: a site that works for a machine reading structured content usually works better for a person using a keyboard, a screen reader or a slow connection. The agent question is largely the accessibility and data-quality question with a commercial deadline attached.

Frequently asked questions

Can AI agents complete a purchase on my Shopify store?

Yes, in most cases, and without you enabling it. Shopify extended its WebMCP tool support to checkout on 28 September 2026, including Shop Pay, letting browser-based agents read checkout state, update supported fields and submit the order after buyer confirmation. Shopify stated these tools do not expose a new API and do not require merchant configuration, which means there was no opt-in step for merchants. If you are on Shopify, assume agent checkout is available on your store unless you have confirmed otherwise.

Why did Amazon block Meta's Muse agent?

Amazon began blocking Muse on 20 September 2026, twelve days after Meta launched it on 8 September. Amazon cited undisclosed browsing, the agent's use of stored credentials and violations of its service terms, and said it had not been given notice or a choice about whether its store would be available through Muse. Amazon acted after Meta declined a request to remove the bot. It follows earlier Amazon moves against other shopping agents, including a November 2025 lawsuit against Perplexity over its Comet browser.

Can I block AI shopping agents with robots.txt?

Not reliably. robots.txt is a published policy request, not enforcement, and the server must accept the request in order to serve the file. More specifically, OpenAI, Google and Perplexity all state they do not honour robots.txt for user-initiated fetches, where a person has asked their assistant to look at a page. Anthropic is the one major operator that states it respects robots.txt across training, search indexing and user-initiated fetches. To actually refuse agent traffic you need WAF rules or rate limiting at the edge, plus terms of service that state your position.

What is Web Bot Auth?

Web Bot Auth is a draft IETF protocol that has bot and agent operators cryptographically sign their HTTP request headers, so a site receives verifiable proof of which operator is making a request rather than a self-declared user agent string that anyone can copy. It is the identity layer that makes selective allow-and-block decisions accurate instead of crude. Adoption is partial because the protocol is still a draft, so any blocking policy today carries some risk of false positives against real customers.

Who is liable if an AI agent's order turns into a chargeback?

In most cases the merchant. Agent-placed orders are processed as card-not-present and the card networks do not currently extend a liability shift to them, so dispute exposure sits with the merchant. Visa and Mastercard have both launched frameworks that let verified agents transact using tokenised credentials and scoped, auditable mandates, and orders routed through those frameworks carry defined liability. Ask your payment provider in writing whether it supports a network agent framework, and on which card schemes.

Should a small store allow AI agent purchases?

It depends on five factors: purchase complexity, margin per order, fraud exposure, how much your conversion depends on your own merchandising, and any compliance constraints. Commodity and replenishment retailers with healthy margins and low fraud exposure should generally allow agents, because the traffic is close to incremental. Considered-purchase, high-fraud or age-restricted businesses should restrict it and say so in their terms. Most merchants sit in the middle, where the right move is to allow but instrument and rate-limit agent traffic before optimising for it.

The takeaway

The decision you are making is not whether AI agents should be able to buy from you in principle. It is whether you find out your current position from a dashboard you built, or from a dispute ratio in six months. Score your business on the five factors, check whether your platform has already answered the question for you, get your payment provider's position on agent liability in writing, and segment agent sessions in analytics before you change anything else. The merchants who handle this badly will not be the ones who chose wrong. They will be the ones who never knew a choice had been made.

AI shopping agents can now check out on your site. Should you let them?