AI agents that shop: how a small e-commerce business gets ready

AI agents, the assistants that no longer just give advice but place the order themselves, are starting to pay for real: Walmart opened its doors to them on October 21, 2026, with spending limits and customer approval built in. For a small e-commerce business, the best response is to learn how to recognize these agents, let your payment provider handle checkout security, and set your own rules now for disputed orders.

What happened this week in AI agent shopping?

Three announcements in two days show that agent-led purchasing is leaving the lab. They come from a retailer, a card network, and a payment provider, which covers the whole chain.

On October 21, 2026, Walmart introduced Agent Profiles. Within the next month, each agent a customer uses will get its own profile inside that customer's account. The customer decides whether to approve every purchase or to let the agent spend up to a limit, for example $50, $100, or $200. The agent never sees the card number and can't change payment methods. The same day, TechCrunch pointed out that Amazon has gone the other way and started blocking agents that buy on behalf of its shoppers.

Also on October 21, Stripe and Anthropic announced that Claude Duet, a new Anthropic app for small business owners, can make purchases on any website through Link, Stripe's wallet. The owner approves each purchase, and the agent then pays with a one-time virtual card limited to one merchant and one amount. Claude's help page notes that a merchant can decline or block the payment and that some sites prevent Claude Duet from paying. For now, the feature is US-only.

The day before, on October 20, 2026, Mastercard opened its Agent Pay for Machines program to developers. It lets an agent pay for digital services within a budget the business sets in advance. According to Mastercard, the real difficulty lies in authorization: you need to know who allowed the agent to spend, how much, and on what. The program is still a pilot with no commercial offer.

Why should a small business care right now?

Because merchants are already preparing, even though sales made by agents are still rare. That gap leaves a few months to get organized without rushing.

According to PayPal's Pulse report, conducted by Ifop among 301 French companies with an online store between April 23 and May 4, 2026, 80% have already built AI into their day-to-day operations. The same report says 78% need outside support to go further, and that data security is the top obstacle to investment.

At the Assises du Paiement, a French payments conference covered by Républik Retail on October 20, 2026, speakers noted that 63% of the executives surveyed by Ifop for PayPal believe consumers will use AI to shop, while purchases actually delegated to an agent remain marginal. PayPal mentioned its early tests with Perplexity in the US, where transaction volumes stayed limited. One retailer also described recent attacks carried out by large numbers of bots.

So the topic is real, but nobody is asking you to rebuild everything before the holidays.

Should you block or welcome AI agents on your store?

For a small business, the sensible approach is to tell apart the agents that identify themselves honestly from those that hide. Blocking all automated traffic means turning away customers who will increasingly arrive through an assistant, while accepting everything exposes you to fraud.

Amazon and Walmart can afford to build their own tools, whereas a store with fifty or five hundred products will rely on its hosting company and its site protection service. Cloudflare, for example, keeps a list of verified bots and agents: an agent qualifies if it clearly states who it is and follows the site's rules. Since July 1, 2026, agents that sign their requests (each call they send to the site) with a method called Web Bot Auth fall into this category. The signature works like a digital ID attached to every visit, which the protection service checks before letting it through.

In practice, all you need to do is ask your technical provider which bot settings apply today, and check that identified agents aren't caught by an overly broad rule set up years ago against price scrapers.

How do you keep a malicious agent from posing as a customer?

Let your payment provider do its job and keep an eye on unusual orders. The tools announced this week already reduce part of the risk with one-time cards and customer-set spending limits.

At the Assises du Paiement, participants pointed to a real difficulty: many anti-fraud tools rely on the way a human browses a site. A legitimate agent doesn't move a mouse the way you and I do, so it can trigger alerts, while a well-tuned fraudulent bot can imitate a human. That's why payment companies increasingly rely on identifying the agent and on limited permissions.

Ask your payment provider, whether it's Stripe, PayPal, Adyen, or your bank, how it currently handles payments initiated by an agent and whether it plans specific settings. Also review last quarter's unusual orders, such as a series of identical purchases within minutes, a shipping address that changes with every order, or a cart made up only of high-demand products. These are the classic symptoms of a bot attack.

Who is responsible when an agent places the wrong order?

No one has settled this question across the board yet, which is why each merchant needs to set its own rules. Walmart shows one way to do it, though it won't carry over as is to every market.

In its terms for agents, Walmart states that its returns process applies, including when an agent doesn't act as intended. It requires customer approval by default and blocks agents that don't follow its rules. At the Assises du Paiement, several participants summed up the open questions: who bears responsibility for a disputed transaction, how to prove the customer's consent, and how to handle a dispute when the product was presented by an outside platform.

I'm not a lawyer, so my advice as a practitioner is modest: review your terms of sale with your attorney and ask what happens when an order comes in through an AI assistant. A clear, generous returns policy remains, as at Walmart, the best way to reassure a customer trying to delegate a purchase for the first time.

My takeaways: the prescription

1. Take stock of your anti-bot rules with your hosting company or provider, to make sure agents that identify themselves properly aren't rejected by default.
2. Ask your payment provider about its roadmap for agent-initiated payments, virtual cards, and dispute handling.
3. Review unusual orders every month, flagging those that look automated, to find out whether this already affects you.
4. Review your terms of sale and returns policy with a legal professional, adding the case of an order placed by an assistant.
5. Work on your visibility in AI assistants, because an agent only buys from stores it has found. That's what vurto.ai measures: it's the tool we built to track a brand's presence in ChatGPT, Claude, Gemini, and Perplexity.

Agent-led shopping won't replace your store tomorrow morning, but the rules being set right now by the giants, the card networks, and the payment providers will apply to small sites too, and it's better to understand them before the first agent knocks on your door.

Frequently asked questions

What is an AI shopping agent?

It's an assistant such as Claude Duet, ChatGPT, or Gemini that a customer asks to run an errand: find a product, compare options, and pay for it. The customer usually sets a spending limit or approves each purchase. At Walmart, following its October 21, 2026 announcement, each agent will get its own profile in the customer's account, with its purchases shown separately and a spending cap.

Should I block bots and AI agents on my online store?

You usually shouldn't block them all. Blocking all automated traffic means turning away customers who will increasingly arrive through an assistant. It's better to separate agents that identify themselves, for example through Cloudflare's verified bots list and the Web Bot Auth signature, from those that hide. Your hosting company or technical provider can check these settings without any custom development.

How can I limit fraud when an AI agent places an order?

Start with your payment provider and ask how it handles agent-initiated payments. New safeguards, such as Stripe Link's one-time virtual cards or Walmart's customer-set spending limits, already reduce the risk. Also watch for unusual orders: bursts of identical purchases, shipping addresses that keep changing, or carts made up only of high-demand products.

Who is responsible if an AI agent orders the wrong product?

No general rule settles this yet, as speakers at the Assises du Paiement noted in October 2026. Walmart chose to apply its returns process even when an agent doesn't act as intended. For your own store, have an attorney review your terms of sale with this case in mind, and keep a clear returns policy to reassure the first customers who delegate a purchase.

Does agent-led shopping already matter for small businesses?

Volumes are still marginal, but the groundwork is being laid. According to PayPal's Pulse report, conducted by Ifop in spring 2026 among 301 French companies with an online store, 80% already use AI day to day and 78% say they need outside support to go further. The services announced in October 2026 are mostly available in the US for now.

Sources

1. Walmart Makes It Possible for Agents to Shop on Behalf of Customers, While Keeping Customers in Control · Walmart, 2026-10-21
2. While Amazon blocks AI agents, Walmart rolls out the welcome mat · TechCrunch, 2026-10-21
3. Stripe and Anthropic help entrepreneurs run their business inside Claude Duet · Stripe, 2026-10-21
4. How to use Link by Stripe with Claude Duet · Anthropic (Claude Help Center), 2026-10-21
5. What happens when AI agents start paying each other? Watch Mastercard Agent Pay for Machines in action · Mastercard, 2026-10-20
6. Rapport Pulse : le commerce agentique en France (enquête Ifop, 23 avril au 4 mai 2026) · PayPal / Ifop, 2026-05-04
7. [Assises du Paiement] Commerce agentique : entre premières expérimentations et défis du passage à l'achat · Républik Retail, 2026-10-20
8. Verified bots · Cloudflare, 2026-07-01
9. Web Bot Auth · Cloudflare, 2026-10-08