AI Agents Have Started Buying Things Online. Can Your Website Take the Order?

I spent twenty minutes this week reading the announcement that Google had handed its Agent Payments Protocol over to the FIDO Alliance, the same standards body behind the passkeys quietly replacing your passwords. On its own, that is a dry piece of plumbing news. Set beside what Stripe and OpenAI shipped last autumn, it is something else entirely: the point at which the AI on your customer's phone stops merely answering questions and starts buying things.

For two years the worry has been about AI reading and summarising your website before anyone clicks through. That worry has not gone away. But the conversation has moved on. The agent is now reaching for a wallet.

What "an agent bought it" actually means

Here is the concrete version, because the abstract one helps nobody. Last September, Stripe and OpenAI published something called the Agentic Commerce Protocol and switched on Instant Checkout inside ChatGPT. A shopper in the United States can now describe what they want, and the assistant will find it, build the basket and complete the purchase, without ever sending them to the shop's website. Etsy sellers were live on day one. Stripe says more than a million Shopify merchants are next in line.

Strip out the jargon and the protocol is, in Stripe's own words, a shared language between a business and an AI agent. The shop publishes its products and prices in a format the agent can read. The agent assembles the order and pays with a one-time token, what Stripe calls a Shared Payment Token, so the customer's card details are never handed to the chatbot. The merchant still decides what is for sale, how the brand appears, and how the order is fulfilled.

So what does that mean for you, sitting behind a till in Ireland rather than a server farm in California? It means the shop window is moving. For fifteen years the job was to rank on Google so a person would click through to your site. The new job is to be legible to a machine that may never visit your site at all, because it is busy completing the sale further upstream. If an agent cannot read, quote and buy your products, you are simply not in that transaction. There is no bounce notification. You never learn the sale went to someone else.

The plumbing is being laid right now

That is one protocol from one company. The reason I actually sat up is that it is no longer one protocol. Google has its own, the Agent Payments Protocol, and it has just been donated to the FIDO Alliance so that no single company owns the standard. When Google first announced it, the partner list ran past sixty organisations, including Mastercard, Visa, PayPal, American Express and Revolut. These are not startups chasing a headline. These are the companies that move the money.

The clever part of Google's design is a thing it calls a mandate. Before an agent spends a cent, the customer signs a digital instruction that sets out exactly what the agent may buy, within what limits, and for how long. That signed instruction travels with the payment, so the shop and the card network can verify the agent genuinely had permission rather than just possession of a card number. The latest version even covers purchases made while the customer is asleep, within rules they set in advance.

I have been wrong about this sort of shift before. I dismissed voice search as a gimmick years ago and watched a slice of local queries quietly move to it while I was busy being clever about why it would not catch on. So I will not tell you agentic commerce is hype. When the card schemes, the payment processors and the two largest AI companies are all building the same rails at the same time, the rails get built. The only open question is who is standing on them when the first train arrives.

Where this leaves a business that sells online

Let me be straight about who this matters to, because not every business needs to lose sleep this month. If you run a service that people book by talking to you, a solicitor, a physio, a wedding photographer, an agent is not about to complete that transaction for them. The decision is too personal and too considered. You have time.

But if you sell products with prices, a Kilkenny craft brewery shipping cases around the country, say, this is your shop window being rebuilt while you are stocking shelves. And here I will give credit where it is due. If your shop already runs on Shopify, you are near the front of the queue, because Shopify is one of the first platforms wired into ChatGPT's Instant Checkout, and its merchants get early reach into that new channel almost for free. That is a genuine head start. I am not going to pretend otherwise.

The catch is the one that always comes with a walled garden. You get the reach on the day the platform decides to grant it, on the terms the platform sets, for as long as the platform finds it profitable. In effect you are a tenant in someone else's shop. When the rules change, and they always change, you change with them or you leave, and leaving means rebuilding. I have watched too many owners discover the cost of that the hard way, usually on the morning a price rise or a policy they had no say in lands in their inbox.

The platform decision you are actually making

Here is the part the protocol announcements bury in their technical notes, and it is the part that should matter most to you. Both of these standards are open. The Agentic Commerce Protocol is published for any merchant to adopt with their existing payment provider. Google's protocol has just been handed to a neutral standards body precisely so it belongs to no one. Open standards do not reward walled gardens. They reward whoever is on a platform flexible enough to plug into them.

That is the quiet case for owning your site outright on WordPress, the software that already runs a large share of the web's shops. When agentic checkout becomes a plugin, and it will, an open platform can adopt it the same way it adopted mobile, then SSL, then structured data: a capability you switch on, not a migration you dread. You are not waiting for a closed platform to decide your business is worth the engineering effort. If you want the fuller picture of why an open, AI-ready foundation matters, I set out what every business owner should know about AI-powered WordPress separately.

This is also why the way you get online in the first place matters. When you describe your business and an AI builds you a genuine WordPress site you own in about a minute, what you are left with is not a rental. It is a real site, on standard software, on infrastructure you control, ready for whatever the next standard turns out to be.

Now the honest limitation, because there always is one. Being on WordPress does not make you agent-ready by itself. An agent can only buy what it can read, which means your product data, your prices, your stock levels, your descriptions, has to be clean and structured rather than buried in a photo of a chalkboard. The plugins that speak these protocols are still early, and they will lean on your hosting and your payment setup to work properly. Owning an open platform keeps the door open. It does not walk you through it. That part is still on you, and it always was.

The takeaway

For a decade, getting found online meant getting found by people. That is changing. Increasingly your products need to be found, understood and bought by software acting on a person's behalf, and the rails for that are being bolted down right now by the biggest names in payments and AI.

You do not need to do anything dramatic this week. Agentic commerce is early, it is largely American for now, and the first wave will pass most businesses here by. But the platform you choose today decides whether you can step onto these rails when they reach you, or whether you are left watching from a system that was never really yours. If you sell online, that is the question worth sitting with: when an agent comes to buy on your customer's behalf, will your shop be one it can actually read?

Sources

• Stripe newsroom: Stripe powers Instant Checkout in ChatGPT and releases the Agentic Commerce Protocol
• OpenAI: Buy it in ChatGPT, Instant Checkout and the Agentic Commerce Protocol
• Google Cloud: Announcing the Agent Payments Protocol (AP2)
• Google: Donating the Agent Payments Protocol to the FIDO Alliance