Should you let AI agents buy from your store? For most small shops, leave the default and wait: set a 30 day check, block only for nameable fulfilment, relationship or risk reasons, and allow on purpose only if you can handle orders from channels you do not control. On Shopify, you may already be opted in.
Should You Let AI Agents Buy From Your Store? The Short Answer
Wait is the right call for most small stores. Leave the default, put a check in your calendar for 30 days out, and look at where your orders came from. Block if you have a specific reason (below). Allow on purpose only if you can fulfil and support orders from channels you do not control.
The news behind the question: on 2026-09-28, Shopify extended WebMCP to checkout, so a buyer's browser agent can inspect a checkout, change details and place an order with the buyer's authorization (TechCrunch, Sarah Perez). Separately, Shopify's documentation says Agentic Storefronts is active by default for eligible stores.
Here is the catch. Neither TechCrunch nor Shopify says what makes a store eligible, so check your admin rather than assume. You may already be opted in.
This is not a push to chase agent sales, and it is not a scare piece. Agents that work for your shop are a different topic. This one is about agents that show up as the buyer.
What Actually Changed on September 28 (and What Didn't)
Before, a buyer's agent had to read screenshots or scrape pages. TechCrunch reports the new setup works “without relying on screenshots or scraping web pages.” The store exposes three documented tools: get_checkout, update_checkout and complete_checkout. Shop Pay is included.
A hosted MCP server runs alongside it, and both sit on the Universal Commerce Protocol (UCP), per TechCrunch. If MCP is new to you, here is what MCP is in plain English.
What did not change, according to the sources:
- The buyer still authorizes the purchase. TechCrunch and PYMNTS both say orders go through with the buyer's authorization. How that consent is shown to the shopper varies by agent, and the sources do not specify it.
- Payment still processes at standard rates. Shopify's blog (vendor, updated 2026-06-18) says “no transaction fees beyond standard processing rates.”
Keep the sourcing straight. The mechanism and buyer authorization are TechCrunch's reporting. The fee line and default-on setting are Shopify's own words, and Shopify has a commercial interest.
Are AI Agents Already Buying From Your Store? How to Check
If you are on Shopify, “switched on” is plausible. “Orders arriving” is a separate question. Per Shopify's Help Center, agentic storefronts is “active by default for eligible stores,” under a default setting called “Allow Shopify to manage for me.” That means all channels active, direct checkout on, and auto-enrollment in future channels.
The documented place to look is Sales channels > Agenticin your Shopify admin, per the Help Center. Shopify's older blog post gives a different path, which looks stale. Menus get renamed, and this article rests on documentation, not a live admin screen, so treat the path as a pointer.
Per Shopify's blog, ChatGPT and Microsoft Copilot are live channels, with Google AI Mode and the Gemini app rolling out to select brands.
To see whether anything arrived, check your order source or traffic reports for AI referrers. No source we read gives an order volume for a typical small store, so expect to find a small number, or none.
Not on Shopify? BigCommerce announced Storefront MCP in open beta (vendor announcement on X), letting agents search a catalog, manage carts and head to checkout. For WooCommerce and others, no first-party documentation turned up in the sources read. Check your platform's docs and your host's bot rules.
What Amazon's Block of Meta's Muse Agent Tells You
Amazon blocked Meta's Muse shopping agent from amazon.com starting the night of 2026-09-20 (Bloomberg, 2026-09-21; GeekWire via mixed-news.com, 2026-09-22). TechCrunch also reports Adidas blocks agents. No reason for Adidas appears in the sources, so none is offered here.
Amazon's stated reasons: Muse does not identify itself as AI while browsing, Meta did not tell Amazon, and it can reach account pages and order history. Amazon's notice says “Continued access by an unauthorized AI agent violates Amazon's Conditions of Use.” Meta replied that Muse “has no visibility into people's passwords or payment methods.” That is one side's allegations and the other side's answer. No court has ruled, and this article takes no side.
For a small shop, the lesson is narrower than it looks. You are not Amazon. You lack its fraud team and its marketplace-scale reasons to control the customer relationship, so copying the block is not automatically right. But the three questions are fair to ask of any agent. Does it identify itself? Is the buyer's consent clear? What can it see beyond your product pages?
- Identity: does it say it is an AI agent?
- Consent: is the buyer's approval clear?
- Access: what can it see beyond product pages?
When Blocking Makes Sense
Block, or opt a channel out, when one of these is true:
- You cannot fulfil unpredictably: made-to-order goods, tight stock, local delivery limits.
- Your sales depend on a relationship a third-party checkout skips, like subscriptions or wholesale accounts. Shopify's Help Center lists subscriptions, bundles, customizable products and local delivery or pickup as unsupported in Meta's direct checkout.
- You sell regulated or age-restricted goods.
- You have had fraud or chargeback trouble and cannot add review capacity.
- Your support cannot handle “the agent changed the address” disputes.
The responsibility sits with you. Shopify's Supplemental Terms (updated 2026-07-07) say “You remain the seller of record,” and that disabling a channel is your responsibility.
On Shopify, per the Help Center, the steps are short. Go to Sales channels > Agentic, turn off “Allow Shopify to manage for me,” pick a channel, toggle “Shopify Catalog access” and/or “Direct checkout,” and save. No code. Two traps: turning “manage for me” back on re-activates everything, direct checkout included, and catalog access can take up to 7 days to stop data flow.
Outside Shopify, blocking means bot rules at your host or CDN. Cloudflare's blog (2025-10-24, details may have changed) says its merchants can “enable a managed rule that automatically allows all trusted agents registered with Visa or Mastercard.” That matters only if you already use Cloudflare. Whether common firewalls block legitimate agents by default is not confirmed.
One warning in the other direction: a blunt bot block can stop legitimate agents and shoppers' tools alike. Here is the risk side for a small business.
When Leaving the Default (or Waiting) Is the Right Call
The typical small shop sells standard physical products with standard fulfilment and no unusual risk. For that shop, Shopify's Meta page says: “There are no fees associated with selling in Meta's direct checkout. You pay only your standard payment processing fees.”
The contract is less absolute. Section 6.1 of the Supplemental Terms says Shopify “may, in its discretion, assess a fee on transactions” for certain channels. Nothing is announced. So: no fee today on the pages read, and the terms allow one later.
Then there is the growth number. Shopify says (self-reported, no independent source) that AI-driven traffic to Shopify stores grew 8x year over year and orders from AI-powered searches rose nearly 13x in Q1 2026. A multiple from an unstated base says nothing about how many orders a small store gets. Do not plan around it.
If plain-English calls like this are useful, the newsletter sends more, with no urgency attached.
Waiting means asking one question in 30 days: did any order come through an AI channel, and was it normal? What would change the call: a fraud pattern, disputes over agent-changed details, or Shopify announcing authorization rules or merchant controls.
Allow, Block or Wait: A Quick Decision Table
| Situation | Verdict | Why |
|---|---|---|
| Standard products, normal fulfilment, low volume | Wait (leave default) | Orders look like any other at standard rates; check data in 30 days |
| Made-to-order, tight stock or local delivery limits | Block (for now) | You cannot fulfil unpredictable orders |
| Subscriptions, bundles or customizable products | Block or Wait | Unsupported in Meta's direct checkout; the relationship is bypassed |
| Regulated or age-restricted goods | Block | Identity and consent checks matter more than reach |
| Clean product data and capacity to fulfil spikes | Allow on purpose | You can serve channels you do not control, and watch results |
| Unsure whether you are opted in | Check first, then pick | “Eligible” is undefined in every source |
These are judgment calls drawn from documented capabilities and dated sources, not results from running a store through an agent checkout.
What to Watch Before You Change Your Mind
- Shopify defining “eligible” and adding a clear merchant control for WebMCP checkout.
- More retailers following Amazon and Adidas (TechCrunch).
- Agent identity standards maturing. Cloudflare described Web Bot Auth, Visa's Trusted Agent Protocol and Mastercard Agent Pay on 2025-10-24.
- BigCommerce leaving beta with Storefront MCP, and any fee changes under section 6.1 of Shopify's terms.
A placed order is hard to reverse. A cart is not. For the permissions mindset, see how to think about what an agent can reach and when an agent should ask first.
FAQ
Are AI agents already buying from my Shopify store? Am I opted in by default?
Possibly. Shopify's Help Center says agentic storefronts is active by default for eligible stores, and no source defines “eligible.” Check Sales channels > Agentic.
How do I turn off Agentic Storefronts on Shopify?
Turn off “Allow Shopify to manage for me” under Sales channels > Agentic, then toggle catalog access or direct checkout per channel. No documented off-switch for WebMCP checkout was found, so confirm what your change covers.
Why did Amazon block AI shopping agents (Meta Muse)?
Amazon says Muse did not identify itself as AI, Meta did not tell it, and the agent could reach account pages and order history. Meta disputes the framing.
Will my bot protection block legitimate AI shopping agents?
Not confirmed. Cloudflare's 2025-10-24 post describes an allow rule for agents registered with Visa or Mastercard. Blunt rules can block good and bad agents alike.
Does the buyer still have to approve the purchase?
Per TechCrunch and PYMNTS, orders are placed with the buyer's authorization. How that approval is presented varies by agent and is not specified.
What about WooCommerce or BigCommerce?
BigCommerce announced Storefront MCP in open beta (vendor announcement). For WooCommerce, no first-party documentation was found.
Is there an extra fee for orders from AI channels?
Not on the pages read: Shopify says standard processing fees only (self-reported). Its terms let it add channel fees later.
The Short Version (and Where to Go Next)
- The default is probably fine for a standard small shop.
- You may already be opted in, and nobody defines “eligible.”
- Amazon's three questions (identity, consent, access) are the test.
- Block for fulfilment, relationship or risk reasons.
- Set a 30 day check: was any AI-channel order a normal order?
Want more plain-English decisions like this? Subscribe to the newsletter, no urgency attached.
Where next: agents that work for your shop, or the wider map of AI agent use cases for small business.