The order landed at six in the morning: two dozen glazed mugs, paid instantly, no gift note, nobody browsing the site in the minutes beforehand. She runs a small pottery studio and sells most of her stock through her own online shop. She checked for fraud and found none: the card was real, the payment cleared, nothing about the order itself was wrong. What was missing was a person, or at least the ordinary signs of one.
She never found out for certain what happened that morning. But this week gave a very public example of exactly this kind of order, at a much bigger scale, and it's worth understanding before it shows up in your own shop.
When the customer isn't a person
An AI shopping agent is software a customer talks to instead of a website. You tell it "reorder my usual mugs" or "find a housewarming gift under €80," and it goes and buys the thing, often without the person ever loading your page, scrolling your products, or typing a note in checkout. From your side, the order looks thin: no browsing trail, no typed detail, sometimes a purchase completed faster than any human could click through it.
That's not automatically a problem. It might just be a fast, well-behaved customer, or a returning one whose assistant remembers what she likes. The trouble starts when the agent doesn't say what it is.
Amazon just blocked one of the biggest ones
On Sunday, people trying to buy through Meta's Muse, an AI assistant that can shop on a customer's behalf from their phone or Mac, hit an error on Amazon: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use." According to reporting from TechCrunch and Hipertextual, Muse had been browsing and buying without identifying itself as an agent, and had reportedly captured saved account credentials without asking. Meta had never requested Amazon's permission for Muse to operate there at all. Amazon has quietly blocked other shopping agents, from Google, OpenAI and Perplexity, the same way over recent months.
The lesson isn't "Amazon hates AI." Amazon already runs its own AI shopping features. The lesson is that the world's largest online retailer looked at one specific agent, decided it hadn't been given a say in the matter, and shut the door. That's a decision every business with a checkout will eventually have to make, on a much smaller scale.
Two ways an agent can show up at your door
There are two genuinely different ways this happens, and the difference matters more than whether AI is involved at all.
The first is impersonation: the agent just browses like a person would, using no honest signal that it isn't one. That's what got Muse blocked. Nothing about it asked your permission or told you what it was.
The second is identification. A standard called Web Bot Auth, built by Cloudflare with Visa, Mastercard and American Express, has agents attach a cryptographic signature, similar to a signed ID card, to every request they make, replacing the old browser label that anyone could fake. A separate standard, the Agentic Commerce Protocol from Stripe and OpenAI, lets a merchant switch on agent orders deliberately: the business still accepts or declines every order, still processes payment through its own account, still handles returns exactly as before. It's already live for Etsy sellers in the US, and Stripe has said it's coming to Shopify next, where well over a million small shops run their checkout.
Same technology, opposite manners. One sneaks in. The other knocks, shows identification, and waits to be let in or turned away.
What this actually means for a shop like yours
If you sell online today, this probably isn't urgent. Agent shopping is still mostly a US story, and the identification standards above are new enough that most small ecommerce platforms haven't switched them on yet. Don't go looking for special software to bolt onto your checkout this week.
But not deciding is still a decision. Right now, most small shop checkouts have no way to tell a properly identified agent from one that simply showed up. That gap, not artificial intelligence itself, is what Muse walked through before Amazon closed it.
Honest limits
None of this means every unusual order is an AI agent, or that every AI agent is unwelcome. Some businesses will be glad to have a repeat customer's assistant quietly reorder the same thing every year. The point isn't suspicion of every strange order; it's noticing when a decision that should be yours, whether your shop is open to agents at all, has quietly been made for you by whichever platform you happen to use.
Where to start
Ask whoever runs your online shop, Shopify, WooCommerce, or otherwise, whether they support agent checkout standards yet, and what happens today when an order arrives with no human fingerprints on it. Until you have a real answer, treat an order like that the way you'd treat any other one you can't quite explain: hold it for a two-minute human check before it ships. That's the same habit that makes any of this safe to hand off later, explained here: Before You Trust an AI Agent, Check Its Reach.