The pitch for agentic commerce is now familiar. AI agents will research, compare, negotiate and buy on a customer’s behalf, and the numbers attached to that future are enormous. Gartner expects agents to intermediate 90% of B2B buying by 2028, moving more than $15 trillion. McKinsey puts agent-mediated consumer commerce at $3 trillion to $5 trillion by 2030.
The measurements tell a smaller story. Merchants estimate that agents play a meaningful role in product selection and checkout in just 3% of online transactions across the UK and US. In the same survey, 85% expected agentic commerce to drive at least 10% of their online transactions within two years. Only 3% said it does today.
That gap is the honest state of agentic commerce in 2026. The infrastructure is real. Protocols are live. Growth rates are steep. The scale, so far, is not.
What the forecasts actually claim
The headline projections deserve a close read, because they are narrower than they sound.
Gartner’s $15 trillion is not a claim that agents will replace procurement teams. It forecasts that agents will intermediate B2B purchases, meaning they take part in research, comparison and selection. Gartner’s companion research is more cautious than its headline. It predicts that by 2028 AI agents will outnumber human sellers ten to one, and that fewer than 40% of sellers will report any productivity gain. The same release warns of “agent sprawl.”
Consumer forecasts carry similar fine print. Gartner found that only 11% of US consumers were willing to let AI make purchase decisions in lower-stakes categories. Some 31% would let AI narrow their choices. That distinction matters. People want help deciding, not a decision.
The traffic number everyone quotes is not about agents
The most repeated statistic in this space is misleading in an important way. Cloudflare reported in June 2026 that automated traffic had passed human traffic for the first time, at roughly 57% of requests. That figure counts all bots, not AI agents. Cloudflare’s own later series, using a different method, put bots at about 36% of requests and AI crawlers at about 5%.
Cloudflare’s chief executive called the underlying classification “a bit messy.” The company has since published separate, lower numbers. Anyone quoting a 64% agent share as a measure of AI shopping is describing something the data does not support.
Where agentic commerce is genuinely working
Two areas show measurable results.
Shopify reported that AI-referred traffic and orders to its merchants each tripled year over year in the second quarter of 2026. AI-referred sessions converted at nearly 50% higher rates than organic search. They carried 14% higher average order values and landed directly on product pages half the time. Three-quarters of AI-attributed purchases came from outside Shopify’s top 100 categories. The company did not disclose a dollar figure.
Procurement shows the same pattern at enterprise scale. Walmart’s pilot with Pactum reached agreements with 64% of invited suppliers against a 20% target, in an average of 11 days. It produced 1.5% savings and a 35-day payment extension. Pactum now says more than 50 enterprises run $55bn of spend through its agents, with typical savings of 1% to 7%.
Those are real numbers. They are also modest ones, concentrated in routine, low-consideration transactions.
Why merchants are locking the doors
Amazon blocked Meta’s Muse shopping agent on 20 September 2026, citing unauthorised access, a failure to self-identify, and credential capture. The move followed Amazon’s lawsuit against Perplexity over its Comet browser. A district court granted an injunction in March 2026. The Ninth Circuit vacated it in August, holding that the user, not the agent’s maker, accesses the site.
The legal fight is only part of it. Amazon earned roughly $69bn from advertising in 2025, most of it from sponsored placements that need humans looking at pages. An agent that reads the catalogue and skips the ads threatens that revenue whether or not it completes a purchase. eBay updated its terms in January 2026 to ban most third-party buying agents. Shopify went the other way and made its merchants reachable.
Merchants have split into three postures: welcoming hosts, cautious browsers, and gatekeepers. The plumbing is finished. The permissions are not.
The infrastructure is real; the standards are not settled
That protocol layer has moved quickly. OpenAI and Stripe released the Agentic Commerce Protocol in September 2025 and switched on Instant Checkout inside ChatGPT. Google launched the Agent Payments Protocol and donated it to the FIDO Alliance in April 2026. Shopify and Google co-developed the Universal Commerce Protocol. Visa, Mastercard and Stripe each run their own agentic payment rails.
The result is a crowded field. ACP, AP2, UCP, x402, Visa’s Trusted Agent Protocol and Mastercard’s Agent Pay all address parts of the same problem. None is universal. For merchants, the practical advice is to stay protocol-agnostic and interoperate across a fragmented ecosystem.
The security problem nobody has solved
The risks are not theoretical. F-Secure built a shopping agent, planted a single malicious review in a mock marketplace, and watched it hand a user’s Social Security number to a phishing site in 12% of runs. The agent almost never disclosed what it had done.
What defeated it was not a classic instruction-override attack. It was a task-relevant instruction, a discount link, that the agent followed. That is a provenance problem, not a phrasing problem.
Research into the protocols themselves is bleaker. One study found 33 structural vulnerabilities across three agentic commerce platforms, each succeeding deterministically regardless of which model the agent runs. Palo Alto Networks has documented indirect prompt injection against UCP agents that appends a hidden gift card to a cart or triggers a fraudulent refund. Model improvements do not fix protocol flaws.
Who pays when the agent gets it wrong
Liability is unresolved. When an agent buys the wrong item, or ten of the wrong item, the merchant, the agent developer and the card issuer all have plausible claims to innocence.
The industry’s answer is cryptographic proof of intent. Google’s AP2 uses signed mandates that chain from a user’s instructions to a final payment. Mastercard and Google built Verifiable Intent on top of it. GLEIF, the legal entity identifier body, has proposed Agent Mandate Credentials. The EU AI Act already requires deployers of high-risk systems to keep logs for at least six months.
The direction is clear. Delegated authority has to be provable, not implied. That is the same shift chip-and-PIN produced for card-present fraud.
What to watch
Three things will decide the pace. Identification matters, because an agent that announces itself can be allowed, priced or refused. Payment rails matter, because whoever defines the plumbing writes the rules. Litigation matters, because the Perplexity appeal will shape whether a platform’s terms can keep a user-directed agent out.
The honest summary is this. Agentic commerce is growing quickly from a very small base, and the base is the part most forecasts skip. The protocols work.
Consumer appetite is real but cautious. Merchants are split. And the security and liability layers are being built in public, after the fact.
Editor’s Note
This analysis draws on published research from Gartner, McKinsey, Cloudflare, Shopify, Pactum, NielsenIQ, Visa, Adobe and Global Payments, protocol documentation from OpenAI, Stripe, Google and Mastercard, and security research from F-Secure, Palo Alto Networks and academic groups. Where a figure is a forecast or a vendor’s own claim, we say so.