On September 8 Meta launched an agent that can buy from almost any online store by filling in its checkout form. The next day Mastercard launched a service that connects merchants to AI agents through one integration. Getting found by an agent is now something you can buy, which leaves one decision open: who runs it.
Meta's new agent, Muse, went live in the US on September 8, inside WhatsApp, its own app and the web. It shops and books travel, and it checks out in three ways. Shopify stores get the order through their APIs. Sites that accept Stripe Link get paid through Link. Every other store gets a browser session in which the agent types a one-time card number into the same checkout form a person would use. Meta announced no merchant enrollment program and no partner list.
That third mode is the one that applies to every business, including the ones that have never given AI agents a thought. A store that publishes nothing an agent can call still gets shopped. It gets shopped through a page built for a person, on terms the store never set.
On September 9 Mastercard launched Agent Connect. One integration lets a merchant make approved product details, pricing, availability and fulfillment options available across AI models, platforms and agent experiences, then take carts and consumer-authorized payment through them. Global Payments, one of the largest payment processors, is a named adopter, along with Samsung and Trip.com.
A card network now sells the connection to AI agents. That puts ownership of the connection on your desk.
Agents reach a business through one of two doors: an interface it publishes, or the website it built for people.
Every agent that shops for someone needs a way in. The better way is an interface the business publishes on purpose, a defined set of things an agent may look up and do, in a format it can read without guessing. The fallback is the website itself, where an agent reads pages and fills in forms like a very fast, very literal visitor. Muse shows the fallback is already live, shipped inside WhatsApp rather than tested in a lab.
The payments industry is working on the other half of the problem, which is knowing which agent is which. On September 9 and 10 Visa, Mastercard and Ant International proposed shared principles for identifying agents, so that an agent onboarded with one network can be recognized by the others. That is a proposal for now, not a live standard. Reuters reported on September 10 that India's NPCI plans a registry to verify and monitor AI agents paying over UPI, and Amazon, Google and Microsoft already run agent registries of their own. The direction holds steady: agents that identify themselves, calling interfaces that businesses chose to publish.
Last week the agent code became free. This week the connection to agents became a network product.
Our last briefing covered Anthropic open-sourcing its commerce agent code on September 2, and the Universal Commerce Protocol shipping breaking changes just before it. A correction first: we dated that UCP release August 31, the day the coverage landed. The release itself is dated August 25.
In the week since, connecting a merchant to agents went mainstream. Mastercard's Agent Connect puts a card network's brand behind the promise of integrating once and reaching many agents, and Mastercard now hands Anthropic's open-source commerce blueprint to merchants through its Agent Suite. Payment providers moved in the same stretch. PayU launched Agent HQ on September 11, a no-code tool inside its merchant dashboard for making Indian merchants discoverable and transactable on Claude, ChatGPT and WhatsApp, and Worldline shipped a UCP payment handler on September 14.
The protocol migration is the quieter change, and it costs money later rather than now. UCP Checker, an independent crawler, counted 15,735 verified UCP stores in its August report, and one day after the August 25 release almost all of them still declared the April version. The release moved payment into a shared namespace, renamed the mandate capability and removed the old signing-keys field. UCP Checker's warning belongs on every engineer's wall: an integration keyed to the old field "finds nothing rather than complaining." Nothing breaks loudly. The agent just stops finding what it needs.
Researching with AI is already majority behavior. Trusting it with the payment is not.
Sources: Visa Trust Index, conducted by The Harris Poll among 2,065 US adults, May 26-28, 2026, published September 9, 2026, for the 72% and 23%; Bain & Company, September 10, 2026, for the 59% (up from 36% in March 2025). Visa sells payment infrastructure, so treat its survey as vendor research.
An agent will reach you through some door. The one you publish is the one you control.
Start with the counterweight, because it's real. In Visa's survey, 23% of US adults would trust generative AI to carry out a payment, and Visa's CEO said on September 8 that adoption has come for shopping but "not yet for autonomous payments." Mastercard's own forecast, published the same day, expects one in ten online shoppers to use agents routinely to buy and pay by 2030. Anyone promising you agent-driven revenue next quarter is guessing.
Discovery is further along. Bain puts the share of US consumers researching products with AI at 59%, up from 36% in March 2025, and quotes Forrester's estimate that agentic commerce could reach up to a fifth of US ecommerce by 2030. Agents are building shortlists today, while the payment step waits for trust to catch up.
Now put that beside Muse. When an agent buys through your checkout form, your site sees a browser session filling in fields. Nothing in that exchange tells you what the agent has been permitted to do, and nothing holds it to the actions you would have chosen to allow. The form was designed to trust whoever is typing, which made sense when whoever was typing was a person.
The published route now has a well-known vendor, and Agent Connect may be the right answer for plenty of merchants. A card network is a name any finance team already trusts. Mastercard has not published pricing or named the AI platforms and protocols behind the service, and trade coverage describes it as launching rather than broadly live. Before you sign up for any single-integration service, whether it comes from a network, a processor or anyone else, get clear answers on who decides what an agent may call on your own systems, and what happens to that setup if you change payment providers.
That second question matters because the tracks haven't settled. Visa's Trusted Agent Protocol, Mastercard's Verifiable Intent and Ant International's Agentic Mobile Protocol are separate approaches the new framework is trying to line up, and Muse checks out through Shopify, Stripe or a browser depending on the store. A connection wired into one company's product inherits that company's choices while all of this keeps moving.
The connection to agents should belong to the business on the other end of it.
BeaconSpec is the discovery layer for agentic commerce. Point us at the REST, OpenAPI or GraphQL APIs your catalog, booking engine or ordering system already runs. We turn them into one curated server an agent can call, and publish it as a UCP server card at your own /.well-known, so agents can find it without waiting for anyone to put you on a list.
You pick exactly which operations an agent may use. Anything you leave off doesn't exist as far as the agent is concerned, which is a very different position from an agent working its way through a checkout form built for people. When a task needs the customer signed in, like checking an order or placing one, we handle the standard login handshake so the agent acts inside that customer's own account, with no shared passwords.
We host it, or hand you a sealed container to run inside your own environment. BeaconSpec isn't a card network or a payment processor, and the server is built from your own APIs, so it stays yours when your payment provider changes. When the spec moves, as it did on August 25, keeping your surface current is our job. That matters most when a failure shows up as silence.
A smaller, separate thing worth doing today
Cloudflare's new default for AI crawlers takes effect on September 15 for sites that never set their own rules. If you'd rather make that call yourself, answer three plain questions and our AI Visibility Checker writes a robots.txt that says which AI crawlers may reach your site.
Check your AI visibility →No sign-up. Copy the result and paste it into your site.
Agents will come through a door. Publish the one you control.
Meta's agent already buys through checkout forms built for people, and Mastercard now sells a single connection to AI agents. Both say the same thing from different sides: agents are going to deal with your business, and what's still open is who sets the terms.
What you own is the surface: a curated, standards-compliant interface agents can find and buy through, with you deciding what they may see and do, running where you need it to run, and kept correct as the specs change.
Worth watching over the next month: which AI platforms and protocols Mastercard names for Agent Connect, whether Meta opens a way for merchants to enroll with Muse, how many of those 15,735 stores UCP Checker finds on the August 25 version in its next report, and what EMVCo asks of merchants when comment on its draft agentic payments framework closes on September 30.
BeaconSpec exists for exactly this shift: making your business discoverable and transactable by AI agents over UCP, on an interface you publish and control, kept correct as the standards underneath it keep changing.
See what we do • Try the free AI Visibility Checker • Read more articles
David Soden writes about automation, web strategy, and building durable technical systems for businesses. Photography via Pexels (George Becker, Kindel Media, SHOX ART). Figures cited are drawn from Meta's Muse launch as reported by PPC Land and PhocusWire (September 8, 2026); Mastercard's Agent Connect and Agent Suite for Merchants announcement, reported by PYMNTS and Digital Transactions (September 9, 2026); the Visa, Mastercard and Ant International Know Your Agent proposal, reported by Electronic Payments International and Biometric Update (September 9-10, 2026); Reuters on India's NPCI agent registry (September 10, 2026); PayU's Agent HQ (September 11, 2026) and Worldline's UCP payment handler (September 14, 2026) announcements; the Universal Commerce Protocol's August 25, 2026 release notes and UCP Checker's August 2026 report; the Visa Trust Index by The Harris Poll (September 9, 2026) and Visa's CEO at the Goldman Sachs conference (September 8, 2026); Mastercard's "A Short History of the Future of Shopping and Payments" (September 8, 2026); and Bain & Company's September 10, 2026 note, including its citation of Forrester.