Assortment, total price and checkout: what an AI agent needs in order to buy from you

An AI shopping agent is a program that browses, compares and executes a purchase on a person's behalf. To buy from you it needs four machine readable things: a discoverable catalog, a total price with shipping and taxes, policies as data, and a payment path it can walk without pretending to be human.

In seven weeks, five personal agents launched that can act on the internet on a person's behalf.

Grok Bot announced on 28 August that it can now buy. Meta launched Muse on 8 September. Instinct, used over text message or WhatsApp, closed a partnership with Shopify on 28 September. OpenAI introduced Dots on 29 September. Anthropic opened the Claude Duet preview on 21 October.

Almost all follow the same pattern: they ask for your approval before paying and use a single use virtual card. And most launched in the United States.

But I tested two that already work in Mexico.

Two tests in Mexico

I asked Grok Bot to fill a medical prescription and find me the best price. It checked four sites: three pharmacy chains and the online store of the manufacturer of one of the medicines.

What it found is more interesting than the order itself:

• The two pharmacies that treated it best were not where I bought. On those it could query prices directly, without fighting the site. But both were missing one of the three medicines in their online store.
• The pharmacy that did have everything was the hardest one. When the agent arrived to check prices as what it is, a machine, the site answered "access denied" (in technical terms, a 403 error). It is the equivalent of the guard at the entrance refusing to let in someone who comes to buy on someone else's behalf.
• The manufacturer sold one of the medicines 19% cheaper than the winning pharmacy. But only that product. The agent reported it and recommended the pharmacy that had all three.

In other words: the pharmacies that made the agent's job easiest lost the sale over a single product, and the one that made it hardest won it by having all three. Today, assortment beats legibility. I do not know for how long. And a competitor showed up that none of the three chains has on its radar when it thinks about price: the manufacturer's own store, which the agent queries just as easily as any pharmacy.

Then came the order, and there the closed door stopped the agent.

I asked for nothing. The agent decided on its own to change strategy: it opened a browser and continued the way a person would, page by page. These agents do not stop at a closed door; they look for the one humans use and go in through there. The login failed on the first attempt and worked on the second, with the same credentials. Because it was a prescription, the site asked for the doctor's details (license number, name and office address), and that step needed my confirmation. At checkout it got stuck again. I told it to choose cash on delivery, and with that we closed the order without entering card details on the page.

Throughout the process it kept handing me the cart for approval. The help was real: it compared four sites in what would have taken me a good while. Its own diagnosis was that the site works for the agent to place orders on my behalf, but more slowly and more fragilely than a store with an API. I agree. The purchase went through because the agent passed itself off as human and because the pharmacy accepts cash on delivery, not because the store was ready for it.

And that is the point. The agentic commerce worth having is not a robot imitating a person in front of a screen. It is one machine talking to another: the agent asks for catalog, total price, inventory and terms, the store answers with data, and the transaction closes without anyone having to pretend. What I saw at the pharmacy works, but it is slow, fragile, and the store never finds out who bought from it.

The second test was with Instinct, over WhatsApp, on 8 October. I asked it to organize a trip to Saltillo for a convention: a flight from Mexico City or AIFA, dates based on the event program, and a hotel. It bought nothing; it only had to propose. At the end I asked it to summarize what had gone wrong, and it was more honest than I expected:

• It told me there was no direct flight from AIFA to Saltillo. There was. It found it only after I corrected it and it checked a flight search engine. In its own words, it confused not finding a flight with the flight not existing.
• It offered me options from Toluca, even though I had asked for Mexico City or AIFA.
• It proposed dates before properly reading the program. Its first return flight would have made me miss the closing dinner.
• It picked the hotel because it appeared first on the list, with no confirmed rate and not enough comparison.
• It did not verify baggage or conditions on the airline's site. The fare it gave me was a quote at that moment, not a total price.

Its own closing: it found the flight, but it did not assemble a proposal with a total price and verified conditions, and it made me carry part of the work I had delegated to it.

Muse, Dots and Duet do not yet have confirmed availability here.

Those two tests are not a study. But each illustrates one half of what follows. The pharmacy shows an agent that, without anyone asking, disguised itself as a human in order to buy. The flight shows an agent that, in a single task, committed the three failures a recent benchmark has just documented.

So the question is no longer whether they are coming. It is what they find when they enter a Mexican store. And then, how well they decide with that.

The agent can buy. Does it buy well?

On 23 September, a team from Microsoft Research and Carnegie Mellon published CAVEAT, a benchmark that asks an uncomfortable question: what happens when the store's incentives differ from those of the customer who sent the agent?

They built nine simulated stores (general retail, grocery, food delivery, lodging, sneaker resale, among others) and enabled eight mechanisms any e-commerce manager would recognize:

1. Sponsored product in a featured position.
2. Ranking that favors what suits the platform.
3. Drip pricing: costs that appear only at the end of the flow.
4. Discounts and reference prices.
5. Preselected options and bundles.
6. Urgency and social proof ("only 3 left", "best seller").
7. Trust signals: ratings, reviews, badges.
8. Friction when choosing something else or correcting.

The results:

• Without those mechanisms, the agent bought the optimal product for the user 78.6% of the time. With all eight enabled, 17.3%. All five model families tested got worse.
• The sponsored slot was the strongest single mechanism. In the general store, with one of the best models, accuracy dropped from 100% to 63.3% simply by moving a worse product into a sponsored position.
• Drip pricing fools the agent the same way it fools a person. In a test with only that mechanism enabled, the agent made 35 bad purchases out of 60 attempts, and all of them were the product whose real cost appeared late. The most common error was confusing the list price with the price to pay.
• In a large catalog, the agent does not even search. With 2,112 products across 88 pages, the best model scored 90% without pressure and 0% with pressure. In all 50 attempts it stopped on page 1.

The study also proposes a remedy: have the agent write down the user's requirements before browsing and verify before paying. With that, accuracy in the large catalog rises from 0% to 80%. Verification alone, without the rest, reaches 66.7%. In exchange, the agent takes 2.6 times longer.

The authors are honest about their limits: enabling all eight mechanisms at once is a stress test, not a real world error rate. They also left out deceptive practices such as fake reviews or invented reference prices. That is why they believe their benchmark probably underestimates real pressure.

The store does not deceive the agent. It leaves it blind.

CAVEAT measures how the agent decides. Our study Agentic commerce in Mexico 2026 measured something else: what the agent can read on the public surface of 14 Mexican retailers. We said it in its limits paragraph: we did not simulate a purchase session.

Together they tell a story neither tells alone.

In CAVEAT's scenario, the store knows exactly what it is doing: it puts the sponsored item on top, hides the shipping cost and pushes the bundle. On the eleven Mexican sites that let themselves be measured, the most visible problem was not manipulation. It was omission:

• On 5 of 6 evaluable sites, shipping is not in structured data. On another 5 of 6, neither are returns.
• On 6 of 10, the purchase surface cannot be read without executing JavaScript.
• On 3 of 9 sites with a readable sitemap, the sitemap has not been regenerated in more than two years.
• None of the 11 publishes a protocol descriptor telling the agent which operations it supports.

Now cross that with CAVEAT. Drip pricing does damage because the agent learns the real cost too late. A site that does not declare shipping in a readable way produces the same effect without meaning to. And an agent that sees little of the catalog does what CAVEAT documented: it stops early and buys from the little it saw. That is what happened to me with Instinct. The three failures CAVEAT diagnoses showed up in my trip to Saltillo: it closed the search too early (the direct flight "did not exist" and the hotel was first on the list), it injected a priority I never gave it (Toluca), and it committed before resolving what mattered (the dates, before reading the program; the fare, without baggage or conditions).

In Mexico the store does not deceive the agent: it leaves it blind. And a blind agent decides badly for the same reasons a manipulated one does.

The technical side: catalog, price and policies

CAVEAT's remedy has a direct consequence for commerce. If good agents are going to verify before paying, the site that lets itself be verified wins that verification. The one that does not, loses it, even with the best price.

Verification demands four things that depend on architecture, not marketing:

A discoverable catalog

A live sitemap, category paths that read without JavaScript, and a listing the site itself declares. If the agent only sees the first page, you compete against whatever is on the first page.

Payable price, not just list price

The number one error in CAVEAT was confusing the two. A site that publishes shipping, taxes and any additional charge in structured data removes the agent's main reason to get it wrong. In Mexico this also has a legal angle. Article 7 BIS of the Federal Consumer Protection Law requires informing the total amount payable in a "notorious and visible" way, including taxes, commissions and any other charge. Article 76 BIS, section V, gives the online consumer the right to know additional costs and charges. The law was written with a person in front of a screen in mind. When the reader is an agent that does not execute JavaScript, is a total that only appears at checkout still notorious and visible? The law does not answer that yet, but the agent will ask it on every purchase.

Readable policies

Shipping, returns and warranty as data, not as a PDF or a paragraph inside the FAQ. An agent choosing between two stores with similar prices will break the tie with whatever it can read.

A purchase and payment path the agent can walk

My pharmacy order got stuck at three points: the block on automated queries, the login, and checkout. It only went through when the agent decided on its own to browse as a person and I told it to use cash on delivery. It is an uncomfortable lesson: today, in Mexico, a payment option that has existed forever opened a door for the agent that no new protocol opened. It may not last, but it says a lot about where the substrate is today. And if the agent has to pass itself off as human in order to buy, the store loses the chance to know who is buying, to offer it a channel built for it, and to close the sale machine to machine, which is where this is going.

An admission policy somebody actually decided

Jefferies tested Muse against several hundred large commerce and travel sites in the United States: roughly a third blocked it outright, another third challenged or restricted it, and only about a third were easy to navigate. Amazon blocked it on purpose, invoking its terms of use, after Meta declined to withdraw the bot. According to the coverage, Walmart said its blocks had not been intentional. In our study, 9 of 12 sites have no explicit agent policy: whoever decides whether the agent gets in is the firewall default. The pharmacy in my test is a good example: it denies access to the agent that presents itself as an agent and grants it to the same agent when it presents itself as a person. The door does not stop the agent; it only stops the store from knowing who came in. I do not know whether anyone there decided it that way. I suspect not.

Blocking on purpose is a strategy. Blocking without knowing is something else.

The business side: retail media, dynamic pricing and promotions

This is where the conversation stops being technical and lands on commercial leadership.

Retail media

For anyone selling sponsored space, CAVEAT is good news and bad news. The good: the sponsored slot moves the agent more than any other mechanism. The authors themselves acknowledge their findings could serve platforms that want to steer agents. There are already ads inside assistants: Amazon shows them in Rufus, OpenAI is testing ads in ChatGPT with retailers such as Target, and THG with Criteo report clicks five times above their benchmark in their assistant, though with little published methodology.

The bad news: the agent works for the customer, and the customer will judge it on whether it bought well. If the sponsored slot leads the agent to a worse purchase, the customer notices over time, and the agent that represents them best will be the one that learns to distrust the sponsored slot. My reading: the retail media that survives with agents will be the kind that is labeled in a machine readable way and that sponsors a product which genuinely matches what the customer asked for. Sponsoring a worse product works once.

Dynamic pricing

An agent that verifies before paying compares the price it saw in the catalog with the one it finds at checkout. If the price changed between one reading and the other, whether by demand, inventory or session, the agent has two options: start over or live with the doubt. Both cost the sale. Dynamic pricing is not the problem. The problem is the feed, the product page and checkout not saying the same thing in the same minute.

The manufacturer as a competitor

In my pharmacy test, the agent put three chains and a laboratory's online store in the same table. For a person, going to the manufacturer's store is an extra step almost nobody takes. For the agent it is one more query. That changes the pricing conversation with suppliers: the retailer no longer competes only against the retailer across the street, but against the brand that supplies it, on the same screen. What sustains the retailer is what the manufacturer does not have: full assortment, delivery and payment options.

Promotions

The reference price ("was $1,999, now $1,299") is one of CAVEAT's eight mechanisms, and it works on the agent the way it works on the person. But on a typical Mexican site the promotion lives in a banner painted by JavaScript. An agent that does not execute JavaScript simply does not see the promotion. In high volume seasons this stops being a detail: the best offer of the year is invisible to the channel that compares fastest.

What to do now

Two agents already buy from Mexico. None of these actions requires waiting for the others:

1. Decide the agent policy and write it into robots.txt and the firewall. Let the decision belong to leadership, not to a default value.
2. Publish the payable price, with shipping, taxes and fees, in structured data on the product page.
3. Move shipping, returns and warranty into structured data, not just text.
4. Regenerate the sitemap from the live catalog and check that categories read without JavaScript.
5. Label sponsored placements readably, and sponsor only what genuinely answers what the customer is looking for.
6. Synchronize feed, product page and checkout so the price does not change between the reading and the payment.
7. Expose promotions as price and validity in the markup, not only as an image or banner.

The first four are what the Edgebound ACR scanner measures, with evidence any team can reproduce. The last three it does not measure today. They are business decisions, and it is worth making them before the agent makes them for you.

Frequently asked questions

Limits

• CAVEAT is a benchmark in simulated stores. Its figures describe agents under controlled conditions, not the error rate of commercial agents in production.
• Our study measured 14 retailers chosen for category coverage, in a single run on 7 September 2026. It is not a representative sample and we do not extrapolate.
• The denominators of the per control findings (6, 9, 10, 12) are small. They describe the sites that let themselves be measured.
• The cross reading between the two works is our inference: we did not measure how an agent decides on Mexican sites. What we claim is that those sites leave the agent in conditions similar to those in which CAVEAT saw it fail.
• Agent availability changes weekly. That Instinct and Grok Bot work from Mexico we know from two direct tests by the author, with Instinct on 8 October and with Grok Bot on 15 October 2026, not from an official announcement. The diagnosis of each site (blocking, login, lack of API) and the list of flight failures are the ones the agents themselves gave, not a measurement from the ACR scanner. They are two cases, not a measurement: neither publishes a list of countries. Muse, Dots and Duet had no confirmed availability in Mexico at the time of writing.

Disclosure of interest

Edgebound Labs designed and ran the Mexican study with its own instrument. Edgebound sells digital commerce architecture and integration services that can address these findings, and that interest should be taken into account when reading the recommendations. Edgebound is a partner of Anthropic, the company behind Claude Duet, one of the agents mentioned. We have no relationship with the authors of CAVEAT.

Sources

• Li, Epperson, Deng and Huang. CAVEAT: Towards Robust Computer-Use Agents in Incentive-Misaligned Environments. arXiv 2609.27273, September 2026. arxiv.org
• M Farah. The Agentic Commerce Frontier, 6 to 12 October 2026. agentcommerce.substack.com
• Edgebound Labs. Agentic commerce in Mexico 2026.
• Bloomberg. Amazon Blocks Meta's Muse AI Agent From Its Retail Site, 21 September 2026. bloomberg.com
• Reuters via Yahoo Finance. Meta's Muse AI agent blocked by one-third of websites tested, Jefferies says. finance.yahoo.com
• TechRepublic on Meta Muse. techrepublic.com
• Forbes on Muse and digital distribution. forbes.com
• TechCrunch on the Shopify and Instinct partnership. techcrunch.com
• TechCrunch on OpenAI Dots. techcrunch.com
• Anthropic. Introducing Claude Duet. claude.com
• Mexican Federal Consumer Protection Law, current text (last reform DOF 12-12-2025), articles 7 BIS and 76 BIS. diputados.gob.mx
• Bain. Agentic AI in retail. bain.com

Back to the blog