What merchants are actually asking about agentic commerce

Agentic commerce feels like it’s having a Henry Ford moment. Just as the first automotive assembly brought car ownership to the masses, everyone can now have their own AI agent. Except there are no traffic lights yet.

Agentic commerce stopped being theoretical sometime in the last year. Since September, web-scraping agents like Muse, Instinct, and Grok Bot have launched and started placing significantly more orders. Unlike the agentic commerce protocols, merchants didn’t opt in to participating. The traffic just started showing up.

At IMPACT NYC, merchants worked through what that actually means. Here are the agentic commerce conversations that kept coming up throughout the day.

AI agents take the path of least resistance

Agents treat shopping as a task to complete, moving toward whatever path is fastest and most efficient. That starts with being able to find a brand. Product data must be machine-readable and optimized for LLMs. Websites need an llms.txt file at the root of the site, essentially serving as a concierge for scraper agents.

If you have a blanket ban on bots, you’re going to miss out on sales from agents shopping on behalf of legitimate customers.

Forter’s agentic order data shows that screen-scraping agents quickly outpaced commerce protocols. That’s partially because they reach far more stores. They can shop anywhere, while the protocols can only reach stores that have integrated them. Protocols offer more control, but scraping agents continue to grow in popularity as the holidays approach. The practical answer is to offer a path agents prefer while deciding in advance which ones you’ll welcome.

Assistants aren’t just smarter chatbots. Most run on a virtual computer in the cloud that stores a consumer’s credentials and payment details, and they onboard the way a person would: first an email, then a card. Within the first three weeks, 40% of Instinct users gave it their credit card.

How the assistants shop is where merchants have more control than they realize. Most assistants shop by scraping, which our experiment showed to be compute-heavy and error-prone. Protocol-based journeys are 10x faster and use 5x fewer tokens. An API lets merchants control the experience, including setting their own restrictions for uncommon use cases.

Readiness requires protocols both sides can rely on, merchant-controlled rules for what an agent can do at checkout, and a way to verify identity. Human involvement scaled to risk is also important, ensuring trusted customers have less friction.

Who decides what an agent is allowed to do

Every merchant has terms of service for customers. Most don’t have rules for software acting on a customer’s behalf, which can quickly become a problem. The simplest starting point is that agents announce themselves rather than mimic human shoppers.

Once an agent is in, the consensus was that humans should set the policy and define the risk thresholds. Automation can then make decisions at scale.

Purchasing authority is trickier. Agents can over-interpret instructions. They may buy something non-refundable, or something the customer never wanted. Then what? With so few agentic transactions, there’s no clear answer on whether chargeback rights even apply when software hits the “buy” button, and teams are currently reactive. Right now, it falls to the merchant.

Identity is still a gray area

When it comes to agentic traffic, 69% of IMPACT attendees consider trust and fraud to be their biggest concern. Merchants see the agent, not the shopper. Merchants tag agents through fingerprinting, tracking signals like the virtual machines and cloud vendors they run on. Tagging is ongoing and agent behavior evolves constantly. The industry is building more deliberate answers.

Agent registries and protocols such as Skyfire’s Know Your Agent (KYA) and Visa’s Trusted Agent Protocol (TAP) let an agent identify itself in the request header as it tries to load a page, so a site can decide in real time how to treat it. Card networks are working on the intent side. Mastercard’s Verifiable Intent uses a cryptographically signed file that travels with the agent and says the user has been fully authenticated. The specification has been donated to the FIDO Alliance. Commerce protocols offer another route. They can carry a risk signal object and a payload that lets Forter retrieve the customer ID and determine identity, though the merchant only sees the agent’s data center and virtual machine.

Merchants with blanket bans still block self-identifying agents. Adoption is thin, however, and most agents aren’t using these services yet. Open questions remain, such as how to tell whether a return came from the agent or the customer, and how standardization will play out.

Building loyalty when the buyer is a bot

Traditional loyalty programs are built around human attention: points that accumulate, tiers that create status, nudges timed to catch someone mid-browse. Agents optimize for speed and efficiency and won’t necessarily respond to those incentives. Brands spent years pushing app downloads for loyalty and now have to rethink that approach.

The practical obstacle is access. Most agents are stuck in guest checkout because logging in requires OAuth, which most merchants haven’t enabled. If agents can’t sign in, they can’t earn or redeem rewards. Abuse is another concern. Loyalty programs can be gamified, and cascading abuse — rewards being resold, for example — compounds the original loss. One potential safeguard is holding points briefly before crediting them, deterring bad actors.

The early pattern is that identity is the foundation and the prerequisite for any policy. Rewards come after. Merchants who can’t tell who or what is behind a loyalty account can’t decide what that account should earn.

Where this leaves merchants

None of these conversations ended with an answer, because there isn’t one yet. Agentic commerce is too new for a playbook to exist, and a clear winner has yet to emerge.

The Universal Commerce Protocol (UCP) has changed more than 30x since January. September ushered in an explosion of transactions from all agents. Whatever you build toward today might not be the surface that wins. Investing in the foundational layer, including GEO and enabling scraper agents, will pay off regardless of which agent eventually consolidates share. Deeper protocol commitments should be treated as maintenance obligations, not one-time integrations.

That’s arguably the most useful takeaway from the day. The merchants furthest along aren’t the ones with a finished strategy. They’re the ones asking sharper questions earlier than everyone else.

If you want to keep the conversation going, join our VP of Payments next month for Off the Rails: The First 60 Days of Agentic Transactions, a look at what the first wave of AI assistant orders actually looks like, including authorization rates, 3DS outcomes, checkout behavior, and early chargeback patterns.