AI shopping agents and your WooCommerce store: what is happening, and what to do Free & Pro

People are starting to hand shopping tasks to AI assistants: find a waterproof jacket in my size under £150, reorder the coffee I bought in March, check whether that order has shipped. The assistant then has to deal with a store. How it does that is the question this guide answers, along with what a WooCommerce store owner can sensibly do about it in October 2026.

How assistants reach a store today

There are three ways, and most stores are on the receiving end of the first without knowing it.

1. Browsing and scraping. The assistant loads your pages like a browser, reads the HTML, guesses where the cart is and fills in forms. Some ask the customer for their store password so they can log in. It works until your theme changes. You see it, if at all, as odd traffic in your analytics. You cannot tell which assistant it was, and you cannot tell it to stop.

2. Product feeds into a platform’s checkout. You send your catalogue to a platform, and its assistant sells your products inside its own app, with its own checkout and payment flow. Google’s and OpenAI’s commerce efforts work this way. You get orders; the platform owns the customer relationship and the checkout. See Personal Agent Protocol, UCP, ACP, AP2 and MCP: what each one does.

3. The agent comes to your store, properly. The assistant identifies itself, the customer signs in on your site and says what the assistant may do, and the assistant uses an API your store publishes. Your prices, your stock rules, your checkout. This is what the Personal Agent Protocol describes, and what Agent Adapt implements for WooCommerce.

Your three choices

Block agents. Some security plugins and CDNs offer bot-fighting modes that stop automated traffic. They stop the scrapers and also stop the well-behaved agents, and the customer who asked their assistant to shop with you gets "I couldn’t reach that store". Reasonable if you sell nothing online that an assistant could usefully buy. Otherwise it is turning away customers who happen to be using a new kind of browser.

Do nothing. Agents scrape. Carts get built by guesswork. Nobody can tell you which assistant placed which order, and a customer who gave their password to an assistant has given it full run of their account. This is where most stores are.

Serve them properly. Publish the discovery file, verify agents, let customers approve access on your own site, and answer agents from your real catalogue. You gain a record of which agents visit and which orders they bring, control over which agents you accept, and customers who never need to hand over a password. The cost is a plugin and twenty minutes.

What serving them properly involves

With Agent Adapt on a WooCommerce store, the moving parts are these.

• Your store publishes /.well-known/poppy.json. An agent given your domain reads it and knows how to proceed. See What poppy.json is, and what yours says.
• Agents prove who they are. Each one publishes its name and public keys at an address it controls, and signs every request to start a visit. You see the name and the address under WooCommerce → Agents, and you can block any of them. See How your store knows which agent is calling.
• Signed out, an agent can shop. Search your catalogue, read product details, read your returns and terms pages, build a cart with your prices and coupons. Then it hands the customer a checkout link, and the customer pays on your checkout. See What agents can do at your store.
• Signed in, with the customer’s approval, it can use the account. The customer signs in on your site and ticks what the agent may do. Then it can read their orders, reorder, cancel an unpaid order and read saved addresses. Approval lasts 90 days and the customer can end it at any time. See How customers connect their assistant.
• Staff accounts are off limits. An administrator or shop manager account can never be connected to an agent, by any route.

Nothing in that list needs a developer, a feed, or an account with anyone.

What you will see

Orders placed through an agent’s checkout link carry the agent’s name in WooCommerce’s own Origin box, so they show up in the attribution reports you already have. WooCommerce → Agents counts each agent’s visits and orders over the last 30 days. Pro’s Agent insights adds the funnel from visit to order, revenue by agent, and abandoned carts.

What not to expect

Be realistic about October 2026.

• No flood of traffic. The protocol is days old. Assistants that implement it will arrive over months. Installing now means being ready, not being busy.
• No agent payments. The protocol leaves payments open. The customer pays on your checkout. That is a feature for most stores, not a gap.
• No listing anywhere. Nothing advertises your store to agents. A customer has to name you, or an assistant has to know your domain.
• No protection from scrapers. A proper door does not lock the windows. Rate limits apply to agents that use the door.

What to do this month

1. Check the basics: HTTPS, WordPress at the root of your domain, pretty permalinks on, PHP 8.1 and WooCommerce 10 or newer.
2. Install the free plugin and open Tools → Site Health. Fix anything it flags.
3. Set your returns, terms and privacy pages in WooCommerce and WordPress, and make sure they say what a customer would need to know. Agents read them. See Writing store policies an agent can read.
4. Add a line to your privacy policy about connected assistants.
5. Glance at WooCommerce → Agents now and then.

The full list is in Preparing your store for personal agents.

Common questions

Will AI assistants find my store on their own?

Not through the protocol. It has no directory. An assistant reaches your store because the customer asked for it by name or link, or because the assistant already knew the domain. Being findable by search engines matters as much as it did before.

Can an agent buy something without the customer?

Not at a store running Agent Adapt. The agent builds a cart and hands over a link. A person opens it and pays.

Does this replace my product feed to Google or OpenAI?

No. Those are a different model, where a platform sells your products inside its own app. A store can do both. Agent Adapt covers the case where the customer’s own assistant comes to your store.

What if an agent misbehaves?

Block it under WooCommerce → Agents. It is refused from its next request. With Pro you can go further and accept only the agents you have ticked.

Does it slow my store down?

Agent requests are answered by WordPress like any other request, within rate limits (300 calls a minute per visit). The discovery documents are cacheable. There is no background work beyond an hourly clean-up of short-lived records.