By Elena Vasquez

Zero of 122 top Shopify storefronts passed all nine checks for whether an AI agent can resolve a full purchase decision, according to an audit run between August and September 2026. The best performers, three stores, reached seven of nine. All three failed the same two tests: no stated cancellation window and no way to cancel an order.

The audit, run against storefronts selected from published rankings of top Shopify merchants, tested whether an autonomous agent (software that reads a site and executes actions on a user's behalf) could gather information, apply rules, and execute a purchase. The findings sharpen an argument made in September 2026 by Slobodan Manic, who wrote that text-only versions of websites strip out everything a visitor could press, leaving "a brochure … served to the user most eager to act."

What did Shopify actually install?

Shopify switched on WebMCP tools (a protocol that lets browser agents call site functions directly) for every Liquid storefront on August 5. As Manic reported, "the merchants did not build it." The audit confirms this at scale:

• 76 of 86 collected product pages load the same Shopify WebMCP adapter script.
• 89 of 122 stores serve an /agents.md file; 83 are near-identical copies of one Shopify template. Only five were written by the merchant.

Counting agents.md adoption therefore measures Shopify's rollout schedule, not merchant readiness.

The platform layer performs well. A live, non-completing checkout test across 74 stores — create a checkout for one in-stock item to a Boston address, read it, cancel it, cancel it again — passed on every measure: typed status on every step, coded error messages, confirmed cancellation, a refused repeat cancel, and a handoff URL. Median response time was about 1.1 seconds. Shopify says orders from AI-powered searches grew nearly 13 times year over year in Q1 2026.

Where does the default readiness break?

The failures sit between published policy and usable answer. Auditors asked each store's own policy tool six buyer questions:

• "What is the return window for this item?" — 70 of 88 returned a usable answer, the one clear success.
• "What does shipping cost to Boston, and when will it arrive?" — 1 of 88 returned anything; 0 gave a usable answer.
• "Can I cancel an order after placing it, and by when?" — 2 of 88 usable.
• "Can used or open-box items be returned?" — 5 of 88 usable.

Two stores answered the cancellation question with their shipping FAQ. A confident wrong answer is more dangerous than none, because an agent cannot reliably detect the mismatch.

Delivery dates are absent everywhere: none of the 74 live checkouts returned an arrival estimate or carrier. Pickup is invisible: all 93 stores with a UCP (Universal Commerce Protocol, an open commerce API) fulfillment declaration list shipping only, including retailers that visibly offer Click & Collect. And no store exposes a tool to cancel, change, or return an order after placement — a gap in the UCP specification itself, which defines order reading and an event webhook but no amend or cancel operation.

Is this a marketing problem or an organizational one?

Neither. Sorted by owner, the missing pieces map to fulfillment, order management, and legal teams — not the web team. "This is an organizational problem, and the search team cannot fix it alone," the audit concludes. The checks stores pass are platform-generated: catalog, variants, price, checkout. The ones they fail need a commercial rule someone outside the website must write and enforce.

Accessibility data shows the same shared root. On 68 product pages tested, 47% had at least one unlabelled input, 46% an empty link, and 65% of stores using dropdowns had an unlabelled size or option selector. The buy button itself is a native, named button 92% of the time when present. Label the markup once, and screen-reader users, keyboard users, and agents all benefit.

What changed on September 28?

Shopify announced WebMCP support in checkout, letting browser agents "read and update Shopify checkouts" with no merchant configuration. A September 30 test at two sites confirmed four tools, including get_checkout and complete_checkout, and a read-only call returned full line items, totals with tax, and coded missing-field messages. Tool descriptions also instruct agents to "use get_checkout to verify the outcome" and "do not resubmit while status is complete_in_progress or completed."

The human-approval rule remains: all 74 checkouts returned requires_escalation with requires_buyer_input, and complete_checkout is to be used "only after the buyer authorizes the purchase." On Shopify today, the agent builds a priced cart, and a person commits the money.

What should merchants do now?

The audit prescribes an afternoon of verification, not a full audit:

• Call the store's own policy tool with real buyer questions and inspect what returns.
• Set return and cancellation rules in Shopify admin; state the same values as numbers in policy pages and FAQ.
• Turn on delivery dates; check /.well-known/ucp.json for pickup; remove old robots.txt.liquid rules blocking /policies/ (51 of 122 stores still do).
• Replace the default agents.md — only five of the top 122 have — and add MerchantReturnPolicy and OfferShippingDetails structured data.

The audit's sharpest open question is the one it did not test: real buyers rarely arrive with a variant ID. The logic for choosing between sizes, models, and related products is merchant knowledge. Shopify can carry it; only the merchant can write it.