Shopify turned agent checkout on by default. The audit to run before Black Friday

Two things happened on Shopify in the last ten days of September 2026, a week apart, and they are being reported as one. On 21 September, Shop Pay direct checkout with Meta's Muse agent was switched on by default for eligible US merchants. On 28 September, Shopify extended WebMCP support to checkout, so a browser agent can complete an order in a shopper's own tab. Different surfaces, different mechanics, and, critically, different opt-out paths. With Adobe forecasting AI-driven retail traffic up around 130% year over year this holiday season, the version of this you cannot afford is the one where you think you switched it off and you did not.

What actually changed, and in what order

The confusion is worth untangling before anything else, because the opt-outs are not interchangeable and a lot of the commentary treats "agentic checkout" as one switch.

Put together, the third and second rows mean a browser agent can now run the whole journey on an eligible Shopify store, from finding a product to the order confirmation page. Shopify listed four checkout tools for agents to call: get_checkout, which reads checkout state, messages and post-completion order details; update_checkout, which changes supported fields; complete_checkout, which submits after the buyer confirms; and navigate_to_storefront, which sends the tab back to the store.

The direction of travel is not ambiguous. Shopify's stated position since its Agentic Storefronts announcement has been to make every store agent-ready by default, and September was that position applied rather than announced. Reporting noted that Shopify's storefront and checkout WebMCP documentation did not say whether merchants can switch off individual tools. If you need certainty about that for a compliance reason, ask Shopify support in writing and keep the answer.

Should you opt out? Probably not, and here is the number why

The instinct when a platform changes your checkout without asking is to switch it off. Before you do, look at what the traffic is worth, because the 2026 data points the other way.

Adobe's holiday forecast has AI-driven traffic to US retail sites rising about 130% year over year, with the largest single-day increases around Thanksgiving, Black Friday up roughly 95% and Cyber Monday up roughly 88%. The behaviour of that traffic matters more than its volume: Adobe reported that in August 2026, visitors arriving with AI assistance added items to cart at a 32% higher rate and generated 43% higher revenue per visit than visitors from non-AI channels. In a July 2026 Adobe survey of 5,000 consumers, 77% of those who had used AI for shopping said they felt more confident in the purchase and 69% said they were less likely to return the item.

That is a demand source that converts better and returns less. Switching it off before peak trades measurable revenue for a reduction in a risk nobody has quantified. Note also the earlier counter-example, which we covered when Walmart's ChatGPT checkout converted three times worse than its own click-through path: AI-referred traffic converting well is not the same claim as AI-completed checkout converting well. The first is well evidenced. The second is new enough that your own data is the only trustworthy source, which is an argument for measuring it carefully this quarter, not for blocking it.

The pre-peak audit: nine checks, in order

This is the work. It is mostly measurement rather than development, and it takes an afternoon on a typical store. Do it before your code freeze begins, because six of the nine items are things you would need to deploy to fix.

1. Place one agent-completed test order end to end. Not a mock. A real order, from product discovery to confirmation, completed by a browser agent on your live store, then refunded. Everything below is a question about that order.
2. Confirm the purchase event fired. Check that your analytics purchase event, ad platform conversion and any server-side tag all recorded that order. A checkout submitted programmatically can skip a client-side event that depends on a page view or a user gesture. This is the same class of failure as the checkout tracking audit we ran when checkout extensibility landed, and the same fix: verify server-side.
3. Check the attribution the order landed with. An agent acting inside a shopper's own session inherits that session's attribution, so the order may be credited to whichever channel brought the shopper, which is arguably correct. Orders arriving through a separate agent surface may have an unfamiliar referrer or none at all. Either way, find out which bucket it fell into before peak.
4. Create a segment for unrecognised referrers now. If agent revenue is going to be absorbed into direct, you want a named segment showing the size of it, not a direct line that mysteriously grows in November.
5. Test every checkout extension against the agent order. Delivery date pickers, gift messages, order notes, custom validation, address rules, packaging options. Anything that requires opening a widget rather than filling a field is the thing most likely to be skipped or to hard-fail.
6. Test the discount path. Whether an agent can apply a code, whether automatic discounts still apply, and whether your Black Friday promotion mechanic depends on a banner being clicked. A promotion that only works when a human sees it is not a promotion for this traffic.
7. Model AOV without post-purchase upsells. A post-purchase offer is an impulse mechanic aimed at a human who has just committed. Assume a materially lower take rate on agent-completed orders and check what that does to your peak AOV forecast.
8. Review fraud and risk rules. Agent-completed orders will look unusual: fast, low interaction, sometimes an atypical device or session fingerprint. Move that pattern to review rather than block, and tell whoever handles manual review what it looks like before Black Friday, not during it.
9. Write down the opt-out state of each surface, with the date. Two toggles in two places, one of which may not exist yet. Record what you checked and when, so that in three weeks nobody has to guess.

What agent checkout changes about CRO itself

There is a longer-term shift here that is worth naming, because it changes what optimising checkout means. A decade of checkout CRO has been about managing human attention: reducing visible friction, sequencing fields to sustain momentum, using urgency and reassurance at the moments doubt appears. An agent has no attention to manage. It reads the state, fills the supported fields and submits.

So the levers split into two sets, and the same checkout now has to serve both.

The pattern in the last two rows is the durable one. Agents reward stores whose state is legible and whose requirements are expressible as data. That is not a new discipline so much as an old one finally getting a commercial reason: the same accuracy that agentic checkout needs is what your feeds, your marketplace listings and your on-site AI search have always needed.

The risk that is actually worth worrying about

It is not fraud, and it is not cannibalised upsells. It is that a default-on change to checkout landed six to eight weeks before the highest-revenue period of the year, and the most likely failure mode is silent. Nothing appears broken. Orders come through. A tracking event does not fire, or an extension quietly fails, or a post-purchase flow does not run, and you find out in the January reconciliation.

That is a monitoring problem, and it has a cheap answer. For the peak weeks, watch four things daily and set an alert on each: purchase events as a ratio of Shopify orders, average order value, checkout extension error rates, and the share of orders arriving with an unrecognised or absent referrer. A divergence in the first ratio is the canary, if Shopify counts more orders than your analytics does, you have found your gap before it has cost you a full month of bidding signal.

And keep this in proportion. Shopify did not add a risk to your store in September; it added a distribution channel and did not ask. The merchants who lose money on it in Q4 will not be the ones who left it on. They will be the ones who left it on without checking what it does to their reporting.

Frequently asked questions

Did Shopify turn agent checkout on without asking merchants?

Yes, for eligible merchants, across two separate changes in September 2026. On 21 September Shopify enabled Shop Pay direct checkout with Meta's Muse agent by default for eligible US merchants, which merchants can switch off in the Agentic sales channel. On 28 September Shopify added WebMCP support for checkout so browser agents can complete an order in the shopper's own tab, and reporting at the time stated merchants did not have to switch anything on for that.

How do I turn off agent checkout in Shopify?

For the Meta agentic channel, go to Shopify Admin, then Sales channels, then Agentic, then the Meta channel, and toggle Direct checkout to OFF. For WebMCP browser agents there is no equivalent documented per-tool switch as of the end of September 2026, which is the more important thing to know: the two surfaces are governed differently and turning one off does not turn the other off.

What is WebMCP checkout on Shopify?

WebMCP is a way for a web page to expose tools that an AI agent running in the browser can call. Shopify extended it to checkout on 28 September 2026 with four tools: get_checkout to read checkout state, messages and post-completion order details; update_checkout to change supported fields; complete_checkout to submit the order after the buyer confirms; and navigate_to_storefront to return to the store. The agent operates in the shopper's own browser session rather than through a separate API.

Should I opt out of agent checkout before Black Friday?

For most merchants, no. Adobe forecasts AI-driven traffic to US retail sites rising about 130% year over year this holiday season, and reported that AI-referred visitors generated 43% higher revenue per visit in August 2026 than visitors from other channels. Switching off a converting demand source before peak trades measurable revenue for a reduction in an unquantified risk. The exception is any store with age-restricted, prescription, licensed or heavily configured products, where a human confirmation step exists for a legal reason.

How will agent orders show up in my analytics?

Inconsistently, and that is the main operational risk. A browser agent acting inside a shopper's session can inherit that session's attribution, so the order may be credited to whatever channel brought the shopper. Agent traffic through a separate surface may arrive with a referrer you do not recognise or with none at all, landing in direct. Before peak, check that your conversion tracking still fires when the checkout is completed programmatically, and create a segment for unrecognised referrers so agent-driven revenue is visible rather than silently absorbed into direct.

Does agent checkout break my checkout customisations?

It can, if a customisation depends on something an agent will not do. Anything that relies on hover, scroll depth, a pop-up being dismissed, a delivery date picker being opened, or an upsell being seen rather than skipped is at risk. The surviving pattern is for required information to be a supported checkout field rather than a UI interaction, so test a full agent-completed order against your live checkout extensions before peak rather than after.

What happens to post-purchase upsells with agent checkout?

Expect a lower take rate and plan for it. A post-purchase offer is an impulse mechanic aimed at a human who has just committed, and an agent completing a task is not that audience. If a meaningful share of your average order value depends on post-purchase upsells, model your peak AOV with and without them for the share of orders you expect to be agent-completed, rather than assuming the historical take rate holds.

The takeaway

Two separate agent surfaces went live on eligible Shopify stores a week apart in September 2026, one with a documented toggle and one without. The right response is not to hunt for the off switch. It is to place a single agent-completed test order this week and follow it through your stack: did the purchase event fire, what channel got the credit, did the checkout extensions survive, did the post-purchase flow run. Adobe's numbers say this traffic converts better and returns less than the traffic you already have. The merchants who get hurt in Q4 will be the ones who never checked whether they could see it.