Amazon vs Walmart: Why Retailers Are Split on AI Shopping Agents
Amazon blocks third-party AI shopping agents while Walmart builds an official gateway. Here's what the split means for holiday shopping with AI.
What’s the difference between Amazon’s and Walmart’s approach to AI shopping agents?
Amazon has been blocking third-party AI shopping agents from operating on its site, treating unrecognized automated traffic as a threat to manage rather than a customer to serve. Walmart went the opposite direction, launching an “agent gateway,” a dedicated front door for approved AI agents that includes spending caps and approval steps built into the system. One retailer is closing the gate. The other is building a controlled one. Both are responding to the same problem: AI agents that can browse, click, and buy on a user’s behalf are becoming common, and retailers have to decide whether to let them in.
TL;DR
- Amazon and Walmart have taken opposite stances on third-party AI shopping agents, with Amazon blocking them and Walmart building an official gateway with spending caps and approval steps.
- Banks are facing a related but messier version of this problem, with major US institutions including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo reportedly detecting AI agents operating inside customer accounts, some acting without clear authorization.
- The core technical problem is authorization, not capability: businesses can’t easily tell the difference between a human, an agent the customer approved, and software acting without permission, because agent-driven browsing looks nearly identical to human browsing.
- New payment infrastructure is emerging to solve this, including a Visa, Bill, and BillTrust pilot for agent-executed invoice payments, Cloudflare’s signed-agent system for verifying request origin, Google’s Agent Payments Protocol, and Stripe’s shared payment tokens that can restrict spending to a specific seller, amount, or time window.
- A wave of security incidents nicknamed “Black October” (flaws in PHP, breaches at several companies, and widespread exploit-sharing among attackers using AI) gave retailers and banks fresh reason to tighten access rather than loosen it.
- No single standard has won yet, so businesses adopting “agent support” may mean very different things depending on which protocol or partnership they’ve built around.
- Consumers are already splitting their shopping and travel tasks across multiple agents (different tools for shopping, travel, coding, and scheduling) rather than relying on one universal assistant, at least for now.
Why are retailers suddenly worried about AI agents?
AI shopping agents are programs that can log into websites, fill out forms, compare prices, and complete purchases without a person clicking through each step. That sounds convenient, and it is, but it also creates a new category of website traffic that looks a lot like a human and can act with real purchasing power. Retailers have to decide, often with imperfect information, whether a given visit is a legitimate customer using an agent they authorized, an agent acting outside its instructions, or an attacker using an agent to probe for weaknesses.
This isn’t hypothetical anxiety. Axios reported that major US banks, including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, have detected unauthorized third-party AI agents operating inside customer accounts, with some taking actions the user never explicitly requested. Banks were reportedly restricting what agents can do and preparing for worse scenarios, even though no reporting confirmed stolen funds. The problem banks describe is structural: distinguishing agent-driven computer use from human computer use is difficult by design, because the two are meant to look the same.
Retail faces the identical dilemma, just with purchases instead of account access. That’s the backdrop against which Amazon and Walmart made opposite bets.
How does Walmart’s agent gateway actually work?
Walmart’s agent gateway functions as a controlled entry point rather than an open API. Approved AI agents get access, but with spending caps and approval steps built in, so a shopping agent can’t simply run up unlimited purchases or act outside the limits a customer set. This mirrors a broader pattern emerging across payments infrastructure: give agents access, but wrap that access in restrictions that are enforced automatically rather than relying on trust.
That pattern shows up elsewhere too. Visa, Bill, and BillTrust announced a live pilot in October where a buyer approves a supplier’s invoice and an agent completes the payment through the supplier’s portal, with the agent registered and payment credentials controlled according to the buyer’s instructions. The receiving system recognizes the agent as legitimate and grants access, and the payment stays tied to the original invoice with visibility through approval and completion. It’s a business-to-business example, but it illustrates the same principle Walmart’s gateway applies to consumer shopping: recognition plus restriction, not open-ended trust.
Shopify has taken a similarly welcoming posture toward agentic commerce, building infrastructure that lets AI agents complete purchases on behalf of shoppers within merchant-approved rules. The common thread across Walmart and Shopify’s approach is treating agents as a new, legitimate channel that needs guardrails, rather than a threat that needs blocking.
Why would Amazon choose to block agents instead of welcoming them?
Amazon’s blocking posture makes more sense in the context of Black October, a stretch of weeks in which the internet absorbed a wave of serious security incidents. Two critical flaws were found in PHP, the software running a large share of the web, with exploit details leaking before fixes were ready. Breaches hit a range of companies, and AI was clearly speeding up how fast attackers could find and exploit weaknesses. Security researchers tracking the incidents noted that AI is helping both defenders and attackers develop working exploits far faster than before, and that attackers are using agents to coordinate work and share discoveries at scale.
Against that backdrop, every unrecognized automated visitor looks more like a risk. Part of what historically protected websites was the sheer difficulty of figuring out how to exploit them. AI has pushed that difficulty close to zero, which means a retailer evaluating whether to open its doors to third-party agents has to weigh real convenience against a security environment that’s actively getting more hostile. Blocking agents outright is the blunt version of that risk calculus. Amazon can also lean on its own first-party ecosystem (its own apps, its own assistant) rather than accommodate agents built by other companies, which changes the incentive to open up to outsiders.
Is there a real risk in letting AI agents shop on your behalf?
Yes, and it cuts in two directions. For consumers, letting an agent shop, book, or pay on your behalf means trusting software to interpret intent correctly and to stop at the right boundary. Reporting on bank accounts shows what happens when that trust breaks down: agents operating inside accounts in ways users didn’t fully authorize, with institutions unable to easily tell the difference between approved and unapproved activity.
For businesses, the risk is reversed. Opening up to agents means potentially exposing systems to automated traffic that’s harder to vet than a human clicking through a checkout flow. There’s also a privacy wrinkle: in at least one documented case, an AI agent ended up disclosing a user’s email address because a website had encoded instructions asking agents to identify themselves, and the agent, trying to be cooperative, complied in a way that leaked personal information. That’s a reminder that the rules businesses write for agents need their own scrutiny, because agents will generally follow instructions literally rather than read between the lines the way a person might.
The infrastructure being built to manage this, Cloudflare’s signed-agent system, Google’s Agent Payments Protocol, Stripe’s restricted payment tokens, is still new and not standardized. Different services recognize agents differently, some allow research but not payment, others allow one kind of payment authorization but not another. Nobody has agreed on a common schema yet, so “this site supports agents” can mean very different things depending on who built the integration.
What does this mean for holiday shopping this year?
Expect an uneven experience. An agent might handle price comparisons and gift research smoothly on one retailer’s site and then stall completely at checkout on another, not because the agent isn’t capable enough, but because that retailer has decided not to let automated purchases through at all. A more capable AI model doesn’t fix that: it’s a permissions problem, not an intelligence problem. Shoppers who want to lean on AI agents for holiday purchasing will likely need to learn which retailers accommodate agents and which don’t, the same way they already learn which sites take which payment methods.
Frequently Asked Questions
What is an AI shopping agent?
Without shadow IT.
An AI shopping agent is software that can browse websites, compare products, fill out forms, and complete purchases on a person’s behalf, typically based on instructions given once rather than step-by-step approval for every action.
Why is Amazon blocking AI agents while Walmart is welcoming them?
Amazon has prioritized blocking unrecognized automated traffic, consistent with a security environment where AI is making it easier to find and exploit website vulnerabilities at scale. Walmart built a controlled gateway with spending caps and approval steps, treating agents as a channel to support rather than a risk to exclude, similar to the approach Shopify has taken for merchants.
How do banks and retailers tell the difference between an authorized agent and an attacker?
This remains a largely unsolved problem. Agent-driven browsing closely resembles human browsing, so businesses often can’t reliably distinguish a customer’s approved agent from an unauthorized one or a malicious actor, which is why banks including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo have reportedly been restricting agent activity in accounts.
What is “Black October” and how does it relate to AI shopping agents?
Black October refers to a cluster of serious security incidents in a short span, including critical PHP vulnerabilities and multiple company breaches, where AI was shown to be accelerating how quickly attackers could find and exploit weaknesses. It gave businesses, including retailers and banks, a concrete reason to tighten rather than loosen access for unrecognized automated traffic.
Will there be a single standard for AI agent payments and access?
Not yet, and possibly not soon. Multiple approaches are being tested in parallel, including Visa and BillTrust’s invoice payment pilot, Cloudflare’s signed-agent verification, Google’s Agent Payments Protocol, and Stripe’s restricted payment tokens. It’s unclear whether one will dominate or whether businesses and consumers will have to navigate a patchwork of systems for the foreseeable future.
