On February 11, Google published a W3C draft that lets any website expose callable functions to AI agents through a single browser API. The next day, OpenAI shipped a coding model that generates over 1,000 tokens per second on non-Nvidia hardware. Two companies, two different problems, one week.

Together, they solve the same underlying challenge. The agentic web needs both a language and a speed layer: a way for agents to understand what websites can do, and the raw throughput to act on that understanding in real time. This week, it got both.

But the real story is not the technology. It is what it means for every business that relies on humans visiting a web page.

The web was built for humans to browse. It is being rebuilt for machines to act. And the companies caught in between face a paradox with no clean answer.

The Website Operator's Paradox

For website operators, WebMCP creates an impossible choice. If you implement it, AI agents can interact with your site efficiently, but they also have less reason to render your pages, see your ads, or engage with your brand experience. If you do not implement it, agents will continue to screenshot and scrape your site anyway, just less efficiently and at higher cost to everyone involved. Either way, you risk becoming background infrastructure for someone else's AI assistant.

As Adweek reported, this shift poses a real threat to operators who rely on direct user engagement. Fewer page views means less ad revenue. Fewer direct visits means weaker customer relationships. The web has always been about human attention. Agents do not have attention. They have task completion.

For merchants, the fragmentation is already real. If you want your products discoverable by both ChatGPT and Gemini, you will likely need to support multiple protocols. Add WebMCP for browser-based agents, and you are now maintaining three protocol implementations alongside your existing website and API infrastructure. As GR4VY noted, orchestration is becoming essential rather than optional.

This is not a future problem. Chrome 146 Canary already supports WebMCP behind a feature flag. Microsoft co-authored the specification, which suggests Edge support is forthcoming. The window for "wait and see" is closing.

What WebMCP and Codex-Spark Actually Change

For the past two years, AI agents have browsed the web the way a tourist navigates a foreign city without a map. Screenshot-based agents capture full-page images and pass them to vision models. Each screenshot consumes thousands of tokens. Each interaction requires a new inference call. A single product search can require dozens of sequential interactions.

WebMCP changes the model entirely. Published as a W3C Draft Community Group Report on February 10, it is a browser API that lets websites declare exactly what actions they support. Instead of an agent guessing what a button does by looking at a screenshot, the website tells the agent directly: here are the available tools, here are their parameters, here is how to call them. A flight booking site might expose searchFlights(origin, destination, date). An e-commerce store might expose addToCart(productId, quantity).

WordLift has called it "the new Schema.org moment," and the comparison is apt. When Google introduced structured data through Schema.org, it transformed how search engines understood web content. WebMCP does the same thing for AI agents. The difference is that agents do not just read. They act. Early benchmarks from the specification show approximately 67 percent reduction in computational overhead compared to traditional visual agent-browser interactions.

But an efficient interface layer is only half the equation. If the underlying model takes 15 seconds per inference call, structured tool access still crawls through multi-step workflows.

That is where Codex-Spark comes in. OpenAI's GPT-5.3-Codex-Spark, running on the Cerebras WSE-3 wafer-scale chip, generates over 1,000 tokens per second: roughly 15 times faster than the GPU-based version. OpenAI achieved an 80 percent reduction in per-roundtrip overhead across the inference pipeline. That is not just faster token generation. That is faster tool calls, faster context loading, faster decision loops.

Put the two together and a multi-step agent workflow, discovering a website's tool contract, making a structured function call, processing the response, and moving to the next step, starts to approach the speed of a human clicking through the same flow. Except the agent does not get distracted, does not mis-click, and does not abandon the cart.

The web just got its first native API for AI agents. And the models just got fast enough to use it.

The Agentic Web Stack Takes Shape

Zoom out and a full protocol stack is emerging. We covered the commerce layer in our analysis of the agentic commerce stack last week. WebMCP and Codex-Spark now fill in the pieces above and below it.

At the browser layer, WebMCP gives agents structured access to any website that implements the specification. At the backend layer, Anthropic's Model Context Protocol (MCP) provides the server-side infrastructure, connecting AI platforms to service providers through hosted servers using JSON-RPC. The two protocols are complementary. A travel company might maintain a backend MCP server for direct API integrations with platforms like ChatGPT or Claude, while simultaneously implementing WebMCP tools on its consumer-facing website for browser-based agents.

At the commerce layer, Google's Universal Commerce Protocol (UCP) and OpenAI's Agentic Commerce Protocol (ACP) handle structured checkout, payments, and merchant integrations. UCP, built with Shopify and Walmart, manages complex retail flows. ACP, developed with Stripe, uses ephemeral shared payment tokens for conversational commerce.

At the speed layer, models like Codex-Spark on purpose-built inference hardware provide the throughput that makes real-time agent workflows viable. You cannot have an agent complete a multi-step purchase flow if each inference call takes 15 seconds.

Four layers. Four protocols. Two weeks ago, only one of them existed in any usable form.

The enterprise adoption signals are already appearing. SAP announced a storefront MCP server for SAP Commerce Cloud, planned for Q2. Visa expanded its Intelligent Commerce program with its own MCP server and a pilot of the Visa Acceptance Agent Toolkit. PayPal will use OpenAI and Stripe's ACP to enable consumers to use their PayPal wallet in Instant Checkout later in 2026.

The Security Gap Nobody Wants to Talk About

The technology is impressive. The security model is not.

The WebMCP specification pushes prompt injection protection to individual AI agents rather than building it into the protocol itself. That is a deliberate design choice, and a controversial one. If a malicious website publishes a tool contract that looks legitimate but contains adversarial instructions, the agent's own defences are the only safeguard. Google's engineers have acknowledged this is an unresolved challenge.

And there is no unified trust framework spanning all four layers. WebMCP pushes trust to agents. MCP handles it through server authentication. UCP and ACP use tokenised payment flows. Every deployment requires bespoke security work at each integration point. That is manageable for enterprise early adopters like SAP and Visa. It is not manageable for the long tail of merchants who will eventually need to support agentic transactions.

As we explored in our analysis of the AI shopping security gap, the distance between consumer enthusiasm and infrastructure readiness remains the central tension of agentic commerce. WebMCP and Codex-Spark close the capability gap. The trust gap remains wide open.

What Comes Next

The timeline is accelerating. Chrome 146 Canary already supports WebMCP. Industry observers expect formal browser announcements by mid-to-late 2026. On the speed front, OpenAI's Cerebras deployment is just the beginning. Non-Nvidia inference is opening up because the economics demand it: when agents are making hundreds of tool calls per session, cost per inference call becomes the binding constraint.

The convergence to watch is when the protocol layer, the commerce layer, and the speed layer all mature simultaneously. We are not there yet. WebMCP is in early preview. UCP and ACP are in pilots. But the pieces are assembling faster than most predicted.

McKinsey recently framed agentic commerce as the next frontier for consumers and merchants. That framing feels accurate, but incomplete. This is not just about commerce. This is about the fundamental architecture of the web shifting from a system designed for human browsers to a system designed for machine agents. Commerce is just where the money is, so it moves first.

Sources

The web just got its first native API for AI agents, and the models just got fast enough to use it. If your website is not agent-ready by the end of 2026, will your customers even notice it exists?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.