Who Lets AI Agents Buy? Shopify, Stripe and Walmart. But not Amazon.

On October 6, Meta and Sierra launched the Personal Agent Protocol, an open standard for how personal agents transact with businesses. The named launch partners were Shopify, Stripe, Walmart, Instinct, Genesys and RocketOTD.

Amazon was not on the list.

Two days later Paul Graham said Amazon was not merely absent but actively blocking, and called it the largest opening he has seen in thirty years.

Read that as a strategy argument, not as news. No Amazon statement exists. No date, no scope, no technical description of what "banning agents" means, whether that is blocking agent traffic, prohibiting it in terms of service, or simply declining to support agent checkout. Graham's post is the only source, and he is a founder-side investor whose entire interest is in openings existing.

What is not in dispute is the partner list. Three of the largest names in commerce and payments publicly committed to serving agent traffic in the same week the largest retailer on the internet did not.

Stills from Instinct's own Shopify launch video, 28 September 2026. No storefront is ever visited.

Three available answers, and most companies pick the third by accident

Position three is the one that matters to almost everyone reading this, because it is not a position. It is what happens when agent traffic hits a stack nobody configured for it.

Your WAF makes the call. Your rate limiter makes the call. Your checkout's bot-detection vendor makes the call, using a rule written in 2023 when every non-human request was presumed hostile. Somebody at your company is already deciding this, and it is probably a default setting.

The demand is real and it is already being turned away

Instinct and Shopify shipped an integration on September 28 putting product discovery, checkout and order updates into one conversation. Noah Shinn's number from that announcement is the useful one: 35% of Instinct's users use it for personal shopping. Tobi Lütke endorsed the result publicly the same day, which is a $100B+ platform's founder-CEO saying this is where the buying surface is going.

Three weeks later, a user posted the other half.

That is one person's experience, not a study. It is also the most honest description of the current state anyone published this autumn. The protocol exists, the partnerships are announced, the demand is demonstrably there, and the actual stores still say no.

Which means the gap between the press release and the checkout page is where the opportunity currently sits.

Nobody has solved the question the stores are actually asking

The stores turning down bots are not being unreasonable. They are being asked to distinguish a customer's agent from an attack, and until recently nothing existed to help them. Stripe's Jeff Weinstein laid out the questions he hears, which is the clearest statement of the real blocker:

Those three questions are the entire problem, and the second one is the hard one. An agent completing a signup end to end and an agent running a refund attack look identical at the network layer. The same capability does both, and it is the same shift that took critical vulnerability counts at Apple, AWS and Google up 6x this spring.

Stripe says it is building a solution and shipped WebMCP on Checkout in September with a published number attached, 42% fewer tokens, which is still the only agent-readiness feature we have seen anyone quantify. Nikita Bier called bot detection and human verification one of the largest open gaps in the market, with small companies and government sites the most exposed.

The design answer is already known and it is not a universal gate. It is risk-scored selective checkpoints, challenging only the traffic that scores high. The blanket version has been run at continental scale and it lost: Weinstein, writing from Europe, said the contrast between using an agent and using the web was "nightmarishly stark" because by the time he had finished approving cookie banners, his agent had already solved the task.

What to do before this is decided for you

This does not need a strategy offsite. It needs four answers, and most companies cannot currently produce any of them.

Find out what you do today. Pull the logs. What share of your traffic is already agent-shaped, and what happens to it? If nobody knows, that is the finding.

Name the owner. Right now the policy lives in a security vendor's default config, which means the decision is being made by someone who has never been told it is a commercial question.

Decide which position you are in. Serving agents is a legitimate choice and so is blocking them. Amazon may well be right. What is not defensible is position three, where the answer is whatever the bot filter does.

Make yourself answerable, not just reachable. If an agent is doing the choosing, the agent's ranking is the new shelf. That makes whether models can find and recommend you stop being a marketing concern and start being a distribution dependency.

Shopify's bet is that the customer relationship is mediated from here and the rails survive. Amazon's reported bet is that the catalogue holds people by force. Both are from named parties in the same month and nothing yet adjudicates them.

Your company is making the same bet this quarter. The only question is whether anyone there knows it.