Silvar
← Blog

AI agents will soon shop for your customers: let them in or keep them out?

Amazon shut Meta's shopping agent out the door, and now Meta and Sierra are presenting a standard 'front door' for AI agents. What does that mean for your online shop?

Abstracte AI-agent met winkelmandje wacht bij de half geopende deur van een webwinkel

Imagine this: a customer asks his AI assistant to find a new work shoe in size 44, check the return conditions, and add the cheapest option to the shopping cart. No human clicking through your webshop, but an agent. That scenario is coming soon, and in recent weeks it became clear that the rules of the game don't exist yet. On October 6, 2026, Meta and Sierra came up with a first attempt to establish those rules: the Personal Agent Protocol. Time to pause and consider a question every webshop owner will ask themselves: do you let these agents in, or do you keep them out?

Where it started: Amazon shuts Meta's agent out the door

The cause was a significant clash. Around September 20 and 21, 2026, Amazon blocked Meta's new AI agent, Muse, from its online store after Meta refused to remove the bot at Amazon's request. According to Amazon, the agent did not identify itself as a bot and appeared to be storing customer login credentials. Meta counters that Muse cannot see user passwords or payment methods.

That this is about more than a dispute between two tech giants is evident from the numbers: according to Similarweb data, Muse had 2.182 million daily active users on October 5. Those are all people who let an agent search, compare, and possibly buy.

Amazon is taking things further in this regard. The company also modified its robots.txt, the file that tells automated crawlers what they can and cannot visit, to block new AI agents from Google, following earlier restrictions on bots from OpenAI, Perplexity, and Anthropic. The result: Amazon product pages no longer appear in some AI search results.

The Personal Agent Protocol: a front door for AI agents

Sierra founders Bret Taylor and Clay Bavor published the Personal Agent Protocol on October 6, which they describe as an open standard for how personal AI agents sign up with companies and what those companies allow them to do. Meta is developing along with them. Sierra names partners including Shopify, Stripe, Walmart, Genesys, Instinct, and Rocket.

The idea in brief:

  • Based on OAuth, with different access levels.
  • As a guest, an agent can, for example, request inventory or a return policy.
  • After logging in, the customer decides whether the agent can only read or can also do things (read-only or write access).
  • The company chooses whether the agent works via the website, via APIs with standards like MCP and OpenAPI, or via the company's own agent.

That last point is interesting: as an entrepreneur, you keep control over how an agent talks to your shop.

What's still missing

Before you enthusiastically get started: you can't use the protocol yet. According to most sources, Sierra will publish the v0.1 specification later in October 2026, along with design workshops and a reference implementation. Payments are not yet included; they are listed as a future extension.

Support is also incomplete. OpenAI and Anthropic, two of the largest agent makers, are not (yet) participating. And Stripe and Shopify are simultaneously part of a competing protocol led by Visa. So it's far from certain which standard will win. Honest advice: monitor and prepare, don't implement now.

What this means for your webshop

Many Dutch webshops run on Shopify or process payments via Stripe. If a standard like this takes off, it could reach you through your own platform without you having to do much yourself. An analyst from Aragon Research sums up the strategic choice sharply: organizations will eventually not be able to afford to block AI traffic endlessly without alienating their own customers.

Top view of a key, open padlock, packages, and checklist as a symbol for access for AI agents

At the same time, you might already be blocking agents without knowing it. On October 6, TechCrunch reported that some blockades are deliberate, like at Amazon, but others result from traditional anti-bot measures against spam and abuse. According to a summary by AI Weekly, Cloudflare's anti-crawler update in September played a role in this.

What you can do now:

  1. Check your bot protection. Look at what settings you have active in Cloudflare or a similar service and what they block.
  2. Read your robots.txt. Do you know which AI crawlers you allow and which you don't? Remember that blocking can also exclude you from AI search results.
  3. Make a conscious choice. Do you want agents to be able to read your inventory and return policy? Should they be able to order too? Put that in writing instead of leaving it to default settings.
  4. Keep an eye on your platform. If you use Shopify or Stripe, follow what they do with PAP or the Visa protocol.

For context: the trust issue of an agent not identifying itself as a bot echoes the transparency rules from the European AI Regulation (Article 50), which have been in effect since August 2, 2026. There is no legal connection between PAP and the AI Act, but the direction is the same: clarity about who, or what, is on the other end.

At Silvar, we build websites, webshops, and AI solutions for SMEs, and we encounter questions like this increasingly often. Do you doubt what your bot settings actually do, or would you like to have a calm discussion about how your shop can prepare for agents? We'd be happy to think it through with you.

Sources

Made with Startspot — build your own site in minutes