Anthropic Built the Shopping Agent and Left Out the Checkout

On September 3, Anthropic published a repository called commerce-agents to GitHub under an Apache 2.0 license. Inside is the scaffolding every retail engineering team has been rebuilding by hand for the past year: an agent loop, a tool layer over the product catalog, an approval gate, and an eval suite.

It ships with four runnable examples covering retail, travel, telecom, and entertainment. It runs on Python 3.11 or Node 22. You need an API key and not much else.

It will not complete a purchase.

That is not a version-one limitation waiting to be filled in. It is the design.

Everyone else in agentic commerce built the payment protocol first and the agent second. Anthropic built the agent and declined the payment.

What actually shipped

The blueprint contains two agents.

The shopping agent faces the customer. It carries five skills: search and discovery, purchase research, planning and goals, customer care, and memory and personalization. It sits behind a StorefrontBackend interface that a retailer implements over its own catalog, cart, order, and policy systems.

The merchant agent faces staff. Performance insights, catalog listings, inventory operations, pricing and promotions, marketing campaigns. Same pattern, different interface.

Three deployment modes come out of one codebase: the Messages API, the Claude Agent SDK, and Claude Managed Agents, which is still in beta. Anthropic also published a Claude Code plugin that scaffolds and reviews a commerce agent from the command line.

Buried in the technical write-up is a finding worth more than the code. According to MarkTechPost's teardown, a single agent loop plus skills outperformed both subagent architectures and single-prompt designs in Anthropic's own deployments. Plenty of retail teams have spent the year building multi-agent orchestration for a job that a well-scoped skill set does without the coordination overhead.

Early adopters named at launch include Shopify, Visa, Mastercard, and Accenture.

The line they drew

The clearest description of the architecture is one sentence: money, writes, and IDs are gated in code. The model proposes. The harness applies.

Read that again, because it is doing real work. The gating is not a system prompt politely asking the model to behave. It is code the model cannot route around. Anthropic looked at prompt injection and decided the answer was to put the dangerous verbs somewhere the language model does not reach.

So the agent searches the catalog, recommends, assembles a cart, and hands the customer to checkout. The retailer keeps payment processing. The retailer keeps the checkout. The retailer keeps the customer data and the relationship, because the whole thing runs inside the retailer's own site or app rather than inside Claude.

Don Apgar, director of merchant payments at Javelin Strategy & Research, told PaymentsJournal what that means:

"The tech is there, consumers are not yet. By launching this product, Anthropic is acknowledging that the industry is way out over its skis on agentic commerce and dialing it back to what merchants and consumers are looking for in 2026."

That is an unusually blunt read of a vendor's positioning from an analyst covering the vendor's market. We think he has it right.

Sixty percent, and why it cuts both ways

The performance numbers are good, and they are also slightly confusing.

Digital Commerce 360 reported that retailers running shopping agents built with Claude have seen shoppers add more to their carts and become 60 percent more likely to complete a final purchase. PaymentsJournal attached the same 60 percent to a different claim: that retail visits driven by AI convert 60 percent higher than other traffic sources, with cart sizes up 30 to 35 percent for one partner.

Those are not the same measurement. One is about agent-assisted shoppers converting better. The other is about AI referral traffic converting better than search or social. A number that portable usually means the underlying study has not been published.

Set the discrepancy aside, because both versions measure the same behavior anyway. Discovery.

A shopper who asks Claude which espresso machine to buy and then buys it herself has used an agent. She has delegated nothing. Apgar's framing again: consumers are increasingly using AI tools in their shopping searches but "are not ready to delegate their purchase decisions at scale."

The industry has spent the past year building for the second behavior and measuring the first. We traced the same gap in what it took for agentic commerce to move from demo to live, and nothing in this release closes it.

Refusing the aggregator move

Ben Thompson's Aggregation Theory explains how internet companies win: own the relationship with the end user, commoditize the suppliers behind you, and take the spread. The aggregator does not need to own inventory. It needs to own demand.

In commerce, checkout is where that ownership becomes real. Whoever holds the payment credential, the order record, and the dispute holds the customer. Every other frontier model provider has been reaching for exactly that position.

Anthropic handed it back. The agent runs on the merchant's property, under the merchant's brand, against the merchant's catalog, and the merchant keeps the transaction.

That is either genuine restraint or a slower route to the same destination. A blueprint that thousands of retailers implement becomes the default shape of the shopping agent, and the party that defines the interface has the upper hand later without needing to hold the credential today. StorefrontBackend is an opinion about how a catalog should look to an agent, and opinions that ship as code tend to stick.

We do not know which reading is correct. We suspect Anthropic does not either.

The layer nobody owns

Under the MM Trust Layer Model, agentic commerce needs trust at three points: discovery, authorization, and settlement.

Discovery is close to solved. The agents find products, and the conversion numbers, whichever version you believe, say shoppers trust what they find.

Settlement is borrowed from elsewhere and works. Cards, bank rails, and stablecoins all move money competently once someone has decided the money should move.

Authorization is the hole. Who authorized this purchase? How does the merchant know the agent speaks for the customer? What happens when it does not, and who absorbs the loss? We have written about the identity crisis underneath agentic payments and about the security gap that opens when agents shop, and the answer has not improved.

Anthropic's answer is the approval gate. A human confirms before anything irreversible happens.

That works. It is honest. It does not scale, and it cannot, because an approval gate is a human in the loop and delegation is the removal of the human from the loop. You cannot ship both and call it finished.

The protocol race we mapped in the agentic commerce standards race is a race to answer the authorization question with cryptography instead of a confirmation screen. Anthropic declined to enter that race and shipped the most usable shopping agent so far regardless.

Which tells you something about where the hard part is. It is not the agent.

If the most capable shopping agent yet built refuses to complete a purchase, is agentic commerce a payments problem or a trust problem?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.