Agentic commerce: is it safe to let an AI agent shop for you?

What is agentic commerce and what changed in October 2026?

Agentic commerce is shopping done by an AI agent on your behalf. The agent does not just suggest a product: it finds it, builds the cart and, if you let it, pays. What changed in October 2026 is that the question is no longer theoretical. On 13 October 2026 Shopify opened its catalog and checkout to any agent, and American Express published how it wants to check that an agent buys only what the customer approved.

Agentic commerce

Purchases that an AI agent starts and completes for a person or a business.

MCP

Model Context Protocol, the open standard an agent uses to connect to outside tools such as a catalog or a cart.

Strong customer authentication (SCA)

The EU rule under PSD2 that payments are checked with two factors, for example your phone and your fingerprint.

The same week, others went the other way. Williams-Sonoma changed its terms to ban shopping agents without written permission, and JPMorgan Chase confirmed that outside agents cannot move money from customer accounts. Some are opening the door and some are closing it. In the middle is the person who has to decide whether to trust the agent.

If you want the basics of how agents work, I covered them in the guide to OpenAI agents: skills, plugins, tools and approvals.

What did Shopify announce with Shop MCP?

On 13 October Shopify released Shop MCP, a single connection that lets an agent search more than 1 billion products, build carts and complete checkout with Shop Pay. According to its developer changelog, search works without credentials, and the agent only completes checkout after the shopper confirms the total and the payment method.

A few details matter when you judge the risk:

• The shopper signs in with Shop to use saved addresses and payment details. Without signing in, the agent can build a cart but cannot pay with Shop Pay.
• Each checkout belongs to one store. The store that sells the product stays the seller.
• There are no webhooks at launch. The agent has to check the payment status itself.
• Shopify has not published countries, fees for stores or a way for a store to opt out. I checked again on 30 October 2026.

Two weeks later, Shopify went further. On 28 October, in its Fall ’26 Edition, it brought Shop Pay checkout to personal AI agents, starting with Meta’s Muse, Claude Duet and Instinct, and launched shop.md, a skill that lets ChatGPT, Claude or another agent search its catalog and pay with Shop Pay. Shopify says the buyer stays in control of each purchase and the card is never shared with the agent: payments use tokens from Mastercard, Visa and Discover, with American Express coming later. Earlier, on 16 October, it had added buyer consent for analytics and marketing to its agent cart and checkout; if the agent sends nothing, the store’s defaults apply.

Shopify’s reason is commercial. Every time an agent had to send the shopper to the store’s website, some sales were lost on the way. That makes sense for the store. For the buyer, the key part is the confirmation step. It is what separates an agent that helps you from one that decides for you.

How does the store know the agent is buying what you wanted?

That is the question American Express is trying to answer with its Intent Intelligence framework, published on 13 October. The idea is to record what the customer approves before the agent buys, and to carry that approval through to the end of the transaction.

It works in three steps. First, the customer says what they want: the store, a maximum budget and other preferences. Second, they confirm who they are and approve that intent. Third, the system creates an intent ID and a proof-of-intent token. The agent uses the token to get a payment credential that only works for that purchase, instead of the card number. The token can later be used to check that the purchase matches what was approved, to fight fraud and to settle disputes.

It is worth being careful about how far this goes. Amex published the framework so the industry can agree on a common approach, and says it is “actively developing” integrations. So it is not running at scale yet: as of 30 October I have not found any announced integration, apart from Shopify’s “coming soon” for Amex payments from agents. But the direction is right: the agent does not get your card, only a permission limited to one purchase.

Why are some stores and banks blocking AI agents?

Because they cannot be sure who is behind an agent or whether it is doing what the customer wanted, and because fraud grows when buying is automated. In October, three cases made this clear:

• Williams-Sonoma emailed customers to change the terms across all its brands, including Pottery Barn. According to KQED, the new terms ban agents from shopping without the company’s written permission, require any automated tool to identify itself and make the customer responsible for everything that happens in their account, “whether or not you authorized that activity”.
• JPMorgan Chase confirmed on 13 October that third-party AI tools can view some account data in read-only mode but cannot send money or pay bills. Jamie Dimon put the reason simply: the bank does not want rogue agents, and there could be thousands of them.
• Amazon blocked Meta’s Muse agent in September. Amazon said Meta never asked for permission, that Muse did not identify itself and that it could reach account data such as order history. Meta says it keeps credentials in secure storage.

Not every store is closing the door. On 21 October Walmart launched Agent Gateway, its own MCP server for approved agents, according to TechCrunch. With Agent Profiles, rolling out in November, each agent gets its own profile in the customer’s account, its purchases show up separately, and the customer chooses between approving every purchase or setting a spending limit. Its terms for agents add two things I think are well designed: the agent cannot see payment details, and the returns policy applies even when an agent does not do what it was asked.

The legal debate is still open. KQED notes that in August a US federal appeals court found that, when an agent shops for someone, it is the user and not the AI company who is accessing the website. That limits how far stores can use anti-hacking law against agents, but they can still set rules in their terms of service. Some legal scholars want the opposite pressure: a rule that agents must act in the consumer’s interest, not the interest of the company that runs the agent.

Is it safe to let an AI agent shop for you?

It depends on three things: who confirms the payment, what credential the agent pays with, and whether the purchase can be undone. With a final confirmation, a scoped credential and a purchase you can return, the risk is close to buying something yourself in a hurry. Without those three, the risk climbs fast.

These are the risks I see most clearly:

1. It misreads what you asked for. “Trainers like the ones I have” can mean many things. If the agent pays without showing you the result, the mistake is already charged.
2. A website gives it hidden instructions. A product page can hide text that the agent reads as an order. This is prompt injection, and there is no complete defence against it today.
3. It has more access than it needs. An agent that stores your passwords or logs in as you can reach everything in that account, not just the cart.
4. Nobody is clearly responsible. Williams-Sonoma’s terms say it plainly: what happens in the account is the customer’s problem. If an agent gets it wrong, the cost may land on you.

When letting an agent buy is safer, and when it is not

My own criteria, based on the October 2026 announcements

	Safer	Less safe
Who pays	You confirm the total and payment method	The agent pays on its own
Credential	Only valid for that purchase	Your saved card or passwords
Type of purchase	Small and returnable	Expensive, custom-made or final sale
Store	Accepts agents and identifies them	Bans them in its terms

It is the same rule I apply to Robinhood’s trading agents: hand over what can be checked and undone, and keep a person on everything else.

What changes in Europe?

There is no clear date in Europe for anything announced in October. Shopify does not list countries for Shop MCP, the Amex framework is still being integrated, and Google, which backs the Universal Commerce Protocol, said in May that its agent checkout would come to Canada and Australia, then the UK. No EU country is on that list.

Two EU rules also stay in place when an agent does the buying:

• PSD2 strong customer authentication. Agent payments are still subject to two-factor checks, and there is no special regime for them so far. In September, a payment started by a Visa test agent with a live Revolut card passed this kind of check in France using a passkey. It was a single test transaction, not a scaled product.
• The right of withdrawal. For online purchases, people generally have 14 days to cancel without giving a reason. There are important exceptions: tickets and bookings for fixed dates, custom-made or perishable goods, and digital content you have already started to download.

Spain also has a new reference point. On 27 October the Spanish Data Protection Agency (AEPD) published ten tips for delegating tasks to AI assistants and agents. Its starting point is that the agent prepares and the person approves: grant only the permissions each task needs, do not press “always allow” without understanding what it covers, require confirmation before sending, sharing, paying or signing up, and assume the agent may meet hidden instructions on websites and in emails. It gives a real case: a user picked “always allow”, and the agent closed a sale and gave the buyer his home address without him knowing.

I am not a lawyer and this is not legal advice. The practical reading is simple: in Europe, paying through an agent will keep asking the person to confirm. That is not a barrier. It is the best protection the buyer has.

What does it mean for businesses?

For an online store, the question is no longer whether agents will arrive, but what policy to have for them. Three questions are worth answering before the first agent order comes in:

1. Do we accept agents, and on what terms? Opening the door can bring sales. Closing it, like Williams-Sonoma, protects against what you cannot identify. What matters is to decide and write it into your terms.
2. How will we know it is an agent, and whose? Asking agents to identify themselves is the minimum. Without that, you cannot measure anything or make a claim.
3. Who carries the cost of a mistake? If an agent buys something the customer did not want, you need to know in advance how the return works, especially for products that cannot be returned.

For a business that buys, the lesson is the same as with any agent that touches money: its own perimeter, approval on by default, clear limits and a named person in charge. An agent can prepare an order for office supplies. It should not sign a contract with a new supplier.

My view: what I would let an agent buy, and what I would not

I would let an agent search, compare and build the cart. That is where it saves real time, and mistakes are cheap. I would let it pay for small, repeat purchases, like restocking something I already buy, as long as it shows me the total and I confirm. And I would give it a credential limited to that purchase, never my card or my saved passwords.

I would not let it buy anything expensive, anything that cannot be returned, or anything that means talking to another person for me, like negotiating a price or making a complaint to a store. I would not give it access to high-value accounts either: the bank, the company account or anything that can move money. It is not a lack of trust in the technology. It is that what an agent does in one second can take weeks to undo.

I think it is good news that Shopify, American Express and Walmart put confirmation, limits and scoped credentials at the centre. And I think it is reasonable for stores and banks to say no to what they cannot identify. Both positions point to the same place: the agent can prepare the purchase, but a person has the last word.

Key takeaways

• Agentic commerce means an AI agent buys for you: it searches, prepares and pays.
• On 13 October Shopify opened its catalog and checkout to any agent, with the shopper confirming the total, and on 28 October it brought Shop Pay to agents such as Muse and Claude Duet.
• American Express published a framework so the agent only pays what you approved, with a scoped credential.
• Williams-Sonoma, JPMorgan Chase and Amazon are holding back agents they cannot identify; Walmart lets them in with profiles, spending limits and returns.
• In the EU, PSD2 strong authentication and, with exceptions, the 14-day cooling-off period still apply. Spain’s AEPD sums it up: the agent prepares, the person approves.
• Hand over the search, yes. The payment, only with a final confirmation and for small purchases you can return.

The article in one image

Frequently asked questions

What is agentic commerce?

It is shopping done by an AI agent on behalf of a person: the agent searches, compares, builds the cart and, if allowed, pays. The difference from a shopping assistant is that the agent does not just recommend. It acts.

What are the risks of agentic commerce?

The main ones are that the agent misreads what you asked for, that a website tricks it with hidden instructions, that it has more access than it needs, and that it is unclear who pays for a mistake. Some store terms make the customer responsible for all account activity, authorised or not.

Is it safe to let an AI agent buy things for me?

It can be, for small purchases you can return, if you set the budget, confirm the total and payment method before you are charged, and the agent does not store your passwords. Without those conditions the risk grows quickly.

What is Shopify Shop MCP?

Released on 13 October 2026, it is a single MCP connection that lets any agent search the Shopify catalog, build carts and complete checkout with Shop Pay. Shopify’s changelog says the agent only completes checkout after the shopper confirms the total and payment method. On 28 October Shopify also brought Shop Pay checkout to personal agents, starting with Meta’s Muse, Claude Duet and Instinct.

What is the American Express Intent Intelligence framework?

Published on 13 October 2026, it records and checks what a customer authorises before an agent buys: the merchant, a maximum budget and other preferences. The agent then gets a payment credential scoped to that intent instead of the card number. Amex says integrations are still in development.

Does Amazon allow AI shopping agents?

Not from every company. In September 2026 Amazon blocked Meta’s Muse agent from browsing and buying on its site. Amazon said Meta never got permission, that Muse did not identify itself and that it could access account data such as order history. Walmart took the opposite route in October: it opened a gateway for approved agents, with a profile for each agent and spending limits.

Sources

1. Shopify Developer Changelog, Add shopping and Shop Pay checkout to any agent with Shop MCP (13 Oct 2026)
2. American Express, Intent Intelligence framework press release (Business Wire, 13 Oct 2026)
3. American Express, Intent Intelligence: building trust in agentic commerce
4. KQED, Too many bots in the kitchen? Williams Sonoma bans AI shoppers (13 Oct 2026)
5. Cybernews, JPMorgan Chase blocks outside AI agents (14 Oct 2026)
6. Forbes, Amazon blocks Meta’s Muse (23 Sep 2026)
7. Google, Universal Commerce Protocol updates (20 May 2026)
8. Osborne Clarke, Agentic payments: a new challenge for Europe’s payments ecosystem (6 Mar 2026)
9. FinanceX Magazine, Agentic payment authentication clears Europe’s strictest bar in France (24 Sep 2026)
10. Your Europe (European Commission), returns and the 14-day cooling-off period
11. Shopify, Exponential: Fall ’26 Edition, Shop Pay in personal AI agents and shop.md (28 Oct 2026)
12. Shopify Developer Changelog, buyer consent in Checkout MCP and Cart MCP (16 Oct 2026)
13. Digital Commerce 360, the American Express framework has no live integrations yet (16 Oct 2026)
14. TechCrunch, While Amazon blocks AI agents, Walmart rolls out the welcome mat (21 Oct 2026)
15. AEPD (Spanish Data Protection Agency), ten tips for delegating tasks to AI assistants and agents (27 Oct 2026, in Spanish)