Continuum
All essays
Essay

The agent is not the store

Why the real opportunity in agentic commerce sits below the chat window.

September 2026

Every technology cycle produces a demo that eventually gets in the way. In commerce, that demo was an AI buying something inside a chat window.

In September 2025, OpenAI launched Instant Checkout with Etsy, Shopify, and Walmart aboard, and the industry briefly agreed on a future: consumers would shop by conversation, and the purchase would complete where the conversation happened. Six months later the feature was gone. Roughly 30 Shopify merchants ever went live. Walmart, the largest partner, measured checkout conversion inside ChatGPT at about one-third of its own website. The system scraped retail sites for product data, so prices and inventory were routinely wrong, and it never solved US sales tax. In March 2026, OpenAI pulled it and handed the surface back to retailers as apps.

This was not the end of agentic commerce. It was the end of a wrong mental model, and the correction is useful for investors: the agent is not the store. Discovery and checkout are different businesses, they are decoupling, and most of the durable value sits in the layers underneath both.

What consumers actually do with AI

The behavior change is real, but it is not the one the demo implied. Adobe found that 41% of US shoppers used AI for online shopping this year. More than half say they trust an AI recommendation as much as a brand's own website. ChatGPT alone fields tens of millions of shopping queries a day.

Yet only about one in five consumers has ever completed a purchase inside an AI tool, and roughly two-thirds remain uncomfortable handing payment credentials to an agent. People research with AI and buy where they already trust the checkout. Walmart's data says the same thing its executives did: discovery in the chatbot, transaction on the site.

The models that work today respect that split. Perplexity runs live in-chat checkout, but it does so through PayPal, across more than 5,000 merchants who remain merchant of record. Google's AI Mode completes purchases on the retailer's own site with Google Pay. Amazon's Rufus, the largest shopping assistant in the country at 300 million users, keeps everything inside a store Amazon already owned. In every working design, the assistant is a front door. The store is still the store.

A protocol war that lasted about a year

Under the surface, the industry spent twelve months fighting over who would write the rules, and the fight is largely over.

Google launched the Universal Commerce Protocol in January 2026, co-developed with Shopify, Walmart, Target, Wayfair, and Etsy, and then donated its payments protocol to the FIDO Alliance. OpenAI and Stripe's competing standard survives as the integration Stripe sells. Visa built an authentication protocol with Cloudflare; Mastercard put live agent transactions on three continents and co-wrote a standard for proving what a user authorized. In April, Coinbase handed its machine-payment protocol, x402, to the Linux Foundation, with Visa, Mastercard, Stripe, Google, and Amazon's AWS as founding members.

When competing card networks join a stablecoin settlement standard, they are not endorsing stablecoins. They are making sure that whatever settles agent transactions, the rules are written in a room they sit in. The standards are hardening. The layers still missing are agent identity, dispute resolution, and interoperability, which is where the next companies come from.

The walled garden and the court ruling

Amazon chose walls. It blocked 47 external AI crawlers, sued Perplexity for sending its shopping agent into Amazon accounts, and built its own agentic stack instead: Rufus for discovery, Buy for Me for purchasing from third-party brand sites, Alexa+ for buying things before you think to shop. The reason is arithmetic. Amazon's advertising business, roughly $68.6 billion a year, is built on humans browsing sponsored placements. Agents do not browse.

In August, the Ninth Circuit vacated Amazon's injunction. An agent running on a shopper's own browser, the court held, is a tool, and the person at the keyboard is the one accessing the site. Retailers lost the ability to treat uninvited agents as computer crime. What remains is terms of service, bot detection, and negotiated APIs. Identification, not litigation, is now the industry's control mechanism, and every retailer knows it needs one.

The layer nobody photographed

Agent traffic to US retail sites rose 4,700% in a year, and agents behave exactly like the traffic fraud systems were built to block: continuous, efficient, relentless. So merchants block them, approvals fall, and legitimate purchases die at the gate.

Riskified, one of the largest fraud vendors in e-commerce, formally disclosed the problem in its SEC filing this spring. Agent transactions strip out the signals its models rely on: the device, the mouse movements, the browsing rhythm. Friendly fraud, already most chargebacks and a $132 billion problem, gets easier when software did the buying. And the court's answer to "who is responsible for the agent's mistake" is, for now, the consumer. That allocation will not survive mainstream adoption, and no card network has written the rules that replace it.

This is the least cinematic layer of the stack and, we think, one of the most valuable: identity for agents, proof of what a human authorized, fraud models that work without human fingerprints, and dispute infrastructure for a world where the customer never visited the site. Someone will build the trust layer of agentic commerce the way the last generation built the fraud stack of e-commerce.

Products are easy. Services are the prize.

Here is the thesis we keep coming back to: agents will matter more for buying services than for buying products. A product is already legible to the internet. It has a spec sheet, a price history, and more reviews than anyone will read; comparing two televisions is a solved problem, and an agent saves you ten minutes. A service is illegible. There is no spec sheet for a contractor, a hotel, or a surgeon; quality hides behind marketing copy, and comparing providers means hours of calls and crossed fingers. Comparison is exactly the work agents do best, and services are where comparison is still expensive. That is where the value concentrates.

The market is already voting this way. The two categories where agents actually close transactions today, travel and B2B procurement, are services businesses. The largest forecast in this whole stack, $15 trillion of B2B spend through agent exchanges by 2028, is mostly companies buying services from other companies.

Services also raise the stakes in a way products never will. There is no return policy on a misbooked trip or a contractor who ghosts. Quality reveals itself only after the money moves, so every agent-booked service is a small act of trust, one more reason the layer nobody photographed matters. The more of the economy agents touch, the more their mistakes are the kind you cannot ship back in a box.

Four margin pools

Stepping back, the economics of the stack sort into four pools.

The toll pool is payments. Whichever protocol wins, transactions clear on card networks and processors that already exist. Visa and Mastercard's fastest-growing revenue lines are no longer processing fees but the services wrapped around them. This pool is real and unavailable to early-stage investors.

The credentialing pool is how an agent safely holds and spends money: scoped payment tokens, agent wallets, spending authority a merchant can verify. This is where seed capital is going first, and where the strategic investors, including the card networks' own venture arms, are co-investing rather than competing.

The data pool is the unglamorous bottleneck that killed Instant Checkout: product catalogs that are accurate, real-time, and machine-readable; the policies and knowledge agents quote on a merchant's behalf; and the new discipline of being cited inside an AI answer at all. Merchants cannot opt out of this spend, which makes it the most immediate recurring revenue in the stack.

The execution pool is the thin layer that turns "the agent knows what to buy" into a completed order on any website. It is the least funded relative to its position, and the likeliest to produce the acquisition that marks the category's first consolidation.

Where we are looking

We are a small fund, so the question is never whether the shift is real. It is where a seed check still buys a meaningful piece of it.

Across all of it, we weight services over goods. The vertical agents we most want to meet sell judgment in categories with no spec sheet: travel, insurance, home services, care. The trust and credentialing companies we want to fund are the ones whose products get more valuable every time an agent books something that cannot be returned.

What we are not underwriting

We are not underwriting general consumer shopping assistants, because distribution is owned by five companies. We are not underwriting new consumer protocols, because governance is captured. And we are not underwriting rebuilt in-chat checkout, because the market already voted.

The front door is not the store

The first wave of agentic commerce failed in public, and that is the opportunity. The chat window turned out to be the front door, not the store. Behind the door, an entire transaction stack is being rebuilt, layer by layer, mostly by companies nobody has heard of yet.

That is where we are looking.

Sources