The task of typing "a tent, sleeping bags, and a camp stove for a weekend camping trip with two kids" into an online shopping search box, then comparing the results one by one and moving them into a cart, still depends heavily on the buyer's cognitive effort. Retailers have tried to offload this burden onto conversational interfaces, but generative AI outputs have always carried the risk of hallucinated prices or unnatural upsell prompts creeping in.
To resolve this friction, Anthropic announced on its official blog on September 2, 2026, the release of a blueprint called "commerce-agents." The company says it has assembled a harness, operational patterns, and guardrails designed to support implementation within days. But a close reading of the published code reveals that its essence is not an automation tool that hands payment over to AI—rather, it is a defensive design that confines the model's authority to "proposals," delegating execution to a deterministic external harness and human approval.
Scope of the Apache 2.0 reference implementation and its maintenance disclaimer
The published source code is managed in the public GitHub repository "anthropics/commerce-agents." The repository was created on September 1, 2026, is licensed under the Apache License 2.0, and carries the copyright notice "Copyright 2026 Anthropic PBC."
The codebase is primarily written in Python and Shell.
The first thing organizations considering adoption should not overlook appears right at the top of the repository's README. The document explicitly states that this is a reference implementation and "it is not maintained and does not accept contributions." Anthropic is not offering this as a commercial SDK with guaranteed ongoing support. Companies that want to put it into production are expected to fork the code and maintain it themselves.
The repository bundles two types of agents: a "shopping agent" on the buyer side for consumers, and a "merchant agent" on the admin side to support store operators. Sample implementations are provided for four workable verticals: retail, travel, telecom, and entertainment (referred to as "ticketing" in the blog post).
Local setup requirements specify Python 3.11 or later and Node 22. In addition, a valid ANTHROPIC_API_KEY must be configured, seven pinned-version Python packages must be installed via pip, and npm ci must be run for eight web applications sharing a single workspace.
According to a notice within the repository, all companies, brands, products, and people included in the samples are fictional (with the exception of ACME, the sole fictional company used throughout). The samples on their own do not place real orders or charge any credit card. Business rules, access authorization, and compliance assurance are all explicitly carved out as the deploying organization's own responsibility.
The structural boundary of a purchasing agent with no payment method
The customer-facing shopping agent is designed to be embedded within a merchant's own application or website. When a user types in natural language, "I need a tent, sleeping bags, and a stove for a weekend camping trip with two kids," the system aims to complete catalog search, multi-product selection, adjustments tailored to customer preferences, direct rendering of product and cart information within the conversation screen, and final cart handoff—all within a single conversational thread.
Customer support inquiries such as order shipping status, return and exchange procedures, and refund policy checks are also answered within the same chat, without redirecting users to a separate FAQ page. This is supported by five defined skill sets: search-discovery, purchase-research, planning-goals, customer-care, and memory-personalization. Meanwhile, the validation of search result legitimacy (grounding), cart and checkout semantics, and UI rendering rules are all controlled via prompt instructions to the model.
For a store to adopt this, it must implement its own "StorefrontBackend" interface to mediate its catalog, cart, order history, and terms-of-service systems. The blueprint only provides the abstract interface definition and the calling tools—it does not come bundled with a generic connector that plugs directly into existing e-commerce platforms.
At the foundation of this design is a structural constraint preventing the AI model from directly moving money. According to the technical explainer document "the-anatomy-of-effective-commerce-agents," at the point of purchase completion, the checkout tool stops processing after simply rendering a physical button on the chat screen for the user to confirm the order. The backend interface the model calls has no charge method whatsoever defined for billing a credit card or bank account.
The official blog states that the policy is to delegate actual payment processing execution to either an existing checkout screen or an external agentic payment provider. Anthropic claims it designed guardrails that strictly bind displayed prices and product information to actual catalog data, in order to prevent unfair upselling of high-priced items. The repository's docs/safety.md lists the enforced rules, the corresponding modules, and the applicable processing paths.
However, the sample code provided does not include an authentication mechanism, and the MCP (Model Context Protocol) server is bound only to a local loopback address. Strengthening security to withstand real commercial environments and building a zero-trust environment are responsibilities that adopting companies must take on themselves.
| Comparison item | Shopping Agent (customer-facing) | Merchant Agent (admin-facing) |
|---|---|---|
| Primary user | Shoppers visiting the site | Store operations staff / administrators |
| Main tasks | Product search, product combination suggestions, cart building, shipping status checks, return/exchange guidance | Sales analysis, product information management, inventory monitoring, price/promotion proposals, campaign drafting |
| Five skills | search-discovery, purchase-research, planning-goals, customer-care, memory-personalization |
performance-insights, catalog-listings, inventory-operations, pricing-promotions, marketing-campaigns |
| Merchant-implemented connection | StorefrontBackend: connects to the merchant's own catalog, cart, order history, and terms-of-service systems |
MerchantBackend: connects to the merchant's own operational systems |
| Handling of updates/payments | Handles up through cart building and handoff to checkout. The model has no direct charge method |
Change proposals are staged with an ID and applied only after human approval |
| Key safety measure | Constraints tying product/price information to catalog data, plus instructions suppressing unfair upselling | Verification at both the staging of a change proposal and its application after approval |
The safety mechanism enforcing two-stage approval on the operational agent
The merchant agent supporting back-office operations is designed to assist store decision-makers. If an administrator asks, "What should I mark down to clear out last season's inventory?" the system produces recommendations based on the store's own sales performance data.
Its functional scope covers answering questions about sales trends, generating pre-emptive alerts that detect inventory depletion before a promotion, recommending prices and promotions informed by historical sales data, and drafting marketing initiatives for product lines that need a sales boost. These are implemented as five domain-specific skills (performance-insights, catalog-listings, inventory-operations, pricing-promotions, marketing-campaigns) that operate on top of a "MerchantBackend" interface the business must supply.
The most robustly engineered mechanism in this operational agent is the two-stage separation of write operations, or "staged-write." As the technical explainer emphasizes, a model's tool call never directly rewrites a store's sales figures or operational settings. Changes that could cause real harm—placing orders, processing payments, issuing refunds, changing prices, or launching ad campaigns—are halted under the control of an external harness, not the model.
Specifically, when the model executes an update tool on the merchant side, the change is not applied immediately. Instead, a server-generated unique ID is assigned to create a "staged change." The apply_change function that actually commits the change succeeds only for an ID that a human has explicitly approved through a legitimate interface. This approval pathway includes an approve button on an admin portal, a confirmation action from the command line, or a platform-level tool-approval prompt within the Claude Managed Agents environment.
Moreover, guardrail validation is not only checked when a change is staged—it is re-checked against current limits when apply_change is actually executed. If a pricing rule's floor changes between the time a change is staged and the time it's approved, the earlier instruction is rejected.
The merchant-side configuration file provides individual enable switches (enable_*) for each of the product editing, inventory, pricing, and promotional campaign systems. Disabling a specific business flow removes the associated tool definitions, related prompt lines, and matching rules from the execution path. Code for unused flows is relegated to the skills/_staged/ directory.
Anthropic summarized this design philosophy with the slogan: "the model's most dangerous action is to propose." The model is never given decision-making power; it operates entirely as a draft-generating function that must pass through human sign-off.
Three runtime paths and the role of the Claude Code plugin
The two agent types presented here are abstracted so that prompts, skill definitions, tool contracts, and guardrails are defined only once and run as-is across three different runtimes.
The first path is a custom loop implementation using the Messages API; the second is orchestration via the Claude Agent SDK; the third is the Claude Managed Agents platform, explicitly labeled as beta on the official blog. Boundary checks, provenance gates, ceiling settings, memory validation, and merchant-side approval gates placed inside tool calls are enforced at tool-execution time, so they function identically across all three runtimes. Meanwhile, external data legitimacy validation (grounding), compute allocation for reasoning, and memory extraction from past logs each depend on runtime-specific implementations.
The execution infrastructure is not limited to Anthropic's official API. The repository's docs/deployment.md details connection procedures via Google Cloud's Vertex AI, Amazon Web Services' Amazon Bedrock, Microsoft Foundry, and enterprise internal AI gateways—consistent with the multi-cloud deployment described in the official blog announcement.
As a means to support developers getting started, a dedicated Claude Code plugin called "commerce-builder" has been provided. Users can install it by first running "claude plugin marketplace add anthropics/commerce-agents," followed by "claude plugin install commerce-builder@claude-commerce-agents."
The plugin comes with four basic commands: "/scaffold-commerce-agent," which generates the skeleton for a new agent; "/add-commerce-flow," which adds a specific business flow; "/author-commerce-evals," which writes evaluation test cases; and "/review-commerce-agent," which inspects for security or compliance violations in the configuration. These commands are also automatically inferred and executed when a developer types a similar request in conversation.
As a quality and safety testing foundation, the repository includes static analysis and code formatting via Ruff, unit test suites via pytest, and automation scripts including install.sh, run_demo.py, smoke_chat.py, screenshot_tour.py, check.py, deploy_managed_agent.sh, and verify_all.py. Whether prompt caching is functioning correctly can be determined by reading the cache_read_input_tokens value included in the turn_complete event at the end of a conversational turn. If this value shows 0 from the second turn onward, it's evidence that the prompt prefix was inadvertently altered and the cache broke.
The official announcement lists major names from payments and consulting, including Accenture, Mastercard, and Visa. But per the company's blog, their role is limited to a "statement of collaboration" to help customers and merchant communities make use of this blueprint. These partners' payment APIs are not pre-integrated into the code repository.
The gap between vendor-promoted figures and what independent surveys show about consumer sentiment
Regarding the effectiveness of commerce-oriented AI adoption, Anthropic opened its official blog post with bold figures. The company states, as its own reported data, that retailers running shopping agents on Claude have seen cart sizes grow by up to 35% and the probability of shoppers completing a purchase increase by 60%. However, the absolute baseline and comparison values behind these 35% and 60% figures—actual average items per purchase or transaction amounts, the measurement period, the sample size, and the specific companies involved in the verification—are nowhere disclosed in the published materials. Statistically verifiable grounds that could withstand outside scrutiny remain undisclosed.
Regarding the background of these numbers, Reuters, in a report distributed via Malaysia's The Star, quoted Angela Jiang, Head of Product for the Claude platform. Jiang stated that at one partner company, cart size increased by approximately 30% to 35%. Here too, the specific baseline cart value or item count, and the underlying conditions, were not disclosed. While the official blog's phrasing could be read as a trend observed across multiple companies, the reality is that it's a localized observation from a single partner company.
Furthermore, the UK tech outlet The Register, citing Adobe Analytics survey data, noted that users who visit retail sites via AI have a 60% higher conversion rate compared to other traffic sources. This Adobe figure is an industry-wide aggregate concerning referral traffic from AI tools in general, and it uses a different calculation basis and population from Anthropic's claim of a "60% increase in purchase completion at stores that adopted Claude agents." The two cannot be treated as equivalent.
Consumer surveys on delegating decisions to AI (by question / target action)
| Survey source | Question / target action and response content (summary) | Response rate |
|---|---|---|
| Gartner | Willing to let AI make purchasing decisions | 11% |
| Accenture | Positive toward delegating routine tasks to an AI agent | 74% |
| Accenture | Ready to let AI make purchasing decisions | 32% |
| Accenture | Would allow fully autonomous purchasing on their behalf | 9% |
Source: Gartner and Accenture surveys as cited by The Register.
Note: The target respondents and question design differ across surveys, and the actions being asked about are not identical. These percentages are not directly comparable as a single unified metric, nor do they indicate a trend over time.
Consumer sentiment in the market is more cautious than vendor optimism suggests. According to Gartner's consumer survey as cited by The Register, even as more consumers use AI for product research and performance comparisons, only 11% said they would be willing to let AI make the actual purchasing decision.
In Accenture's survey, 74% responded positively to delegating routine tasks to an AI agent. Meanwhile, 32% said they were ready to let AI make purchasing decisions, and only 9% said they would allow fully autonomous purchasing on their behalf. These figures reflect willingness toward distinctly different actions.
Anthropic's announcement quotes Kath Gramling, who leads Accenture's global consumer goods, retail, and travel practice. She is quoted saying, "According to recent research, 85% are open to collaborating with AI agents, and nearly 3 in 4 people said they would trust a personal AI agent more than a human best friend to shop on their behalf." This is a promotional endorsement citing the partner's own research, not something that should be taken as a neutral third-party assessment.
Comments from well-known companies such as Visa, Mastercard, Intuit, Priceline, Klaviyo, Wix, Square, Shopify, and Zomato are likewise all marketing testimonials included within Anthropic's own announcement. In actual store operations, the psychological barrier for consumers to hand over their wallets to AI remains substantial.
The dynamic pricing regulatory debate and unclear liability
As AI-assisted purchasing spreads, conflicts between regulation and commercial practice are surfacing. The U.S. think tank Brookings Institution warned in 2026 that the spread of autonomous AI agents is "likely to worsen dynamic pricing disparities." If agents become capable of finely analyzing each customer's purchase history and willingness to pay, there's a risk that surveillance pricing—raising the price presented to an individual—could become widespread.
This issue of AI-driven surveillance pricing was also intensively discussed in a subcommittee of the U.S. Senate Judiciary Committee the month before Anthropic announced its blueprint. In prepared testimony for the hearing, Lindsay Owens, President and CEO of the nonprofit policy organization Groundwork Collaborative, testified that roughly half of Walmart's app users use its AI assistant "Sparky," and that these AI users spend approximately 35% more than non-users.
The catalog guardrails Anthropic built into the blueprint are a technical constraint designed to prevent the phenomenon of models blurting out fictional prices that don't exist. But if a store adopts a design that returns different catalog prices depending on customer attributes, the agent will present that differentiated pricing to the customer just as it is. The policy decision of whether AI should uphold a single fair price or enforce variable pricing falls outside the model's purview and is left to the control of retailers, regulators, and payment networks.
The biggest risk in the payments space is handling disputes over purchases a buyer doesn't recognize. Monica Eaton, founder and CEO of chargeback defense company Chargebacks911, pointed out that the industry has no unified framework for handling cases where a consumer disputes an AI-involved purchase by claiming, "I never approved that order." "It's unacceptable for merchants to be turned into the insurer of a misunderstanding that happened between a consumer and their own AI," Eaton said.
Amid this legal uncertainty, third-party experiments connecting to real-world environments have already begun. Alongside the blueprint's release, Shopify published "Shopify/claude-for-commerce-examples" on GitHub (Apache 2.0, created September 1, 2026). In this implementation example, Anthropic's shopping agent is connected to real accounts via Shopify's Universal Commerce Protocol (UCP) and Sign in with Shop, and the merchant agent is connected to the Admin API.
According to Shopify's UCP technical specification, an agent's profile information is managed via a public well-known URL that is referenced with each request. Trust tiers are defined based on authentication level, and agents that achieve a higher tier are expected to be granted broader access privileges—including the ability to complete checkout directly. This warrants close attention: the defensive wall Anthropic's reference implementation established by omitting a charge method could readily be breached and extended into autonomous payment, depending on the judgment of the connecting protocol or platform.
As The Register summarized, the fundamental barrier holding back the spread of autonomous commerce agents is not technical wiring work. It comes down to whether consumers can be confident that AI is truly acting in the buyer's interest, and reaching consensus on trust and liability—namely, who bears legal responsibility when unexpected financial disputes arise.