AI agents got a way to pay this week: OpenAI launched ChatGPT Wallet with American Express, Mastercard and Visa on 13 November. The same day, by our count, Amazon’s robots.txt file barred 99 named crawlers and AI agents from the whole of amazon.com, and 23 of those names carry the product names of six AI companies, OpenAI’s and Meta’s among them. Our re-count on 14 November found the same 99.
OpenAI’s own launch page names the gap. To accept payment from the wallet, it says, “websites need to ensure agents are not inadvertently blocked”. As we read the week, the agent economy now has two gates: settlement, which the card networks opened, and access, which each store decides.
Business Pill · Agentic Commerce Explained
An evergreen Business Engineer explainer on agentic commerce, when the shopper is an AI agent. It teaches the general idea only and does not discuss Amazon’s robots file, ChatGPT Wallet or Poppy.
The key insight: As we read the week, AI agents now face two gates: the card networks opened settlement through ChatGPT Wallet’s tokens, while access stays store by store, with Amazon’s robots file barring 99 named bots, 23 of them carrying the names of six AI companies, by our count.
OpenAI says ChatGPT Wallet is “the first wallet that lets agents pay without access to users’ actual card details and that requires a security check for every purchase”. The payment network issues a token in place of the card number, and the user approves each purchase with a check such as Face ID, as set out in our explainer on how agent wallets pay. It starts in dots, OpenAI’s agents, for ChatGPT Pro subscribers in the US.
The protocol layer moved the same day. Sierra released version 1.0 of its Personal Agent Protocol, or Poppy, and said Shopify has enabled it for every merchant on its platform. Meta’s Muse “automatically looks for Poppy first on every site it visits”, Sierra says, and more than 100 companies are now design partners, as our piece on Poppy 1.0 set out.
Bot names given the rule Disallow: / (the whole site) in amazon.com/robots.txt on 14 November 2026, grouped by the product name each carries. 99 unique names; the grouping and all counts are our count. A robots file is a request, not a technical block, and does not say who operates each bot.
Gate Two: Access Stayed Store by Store
Amazon’s file gives each of the 99 names the rule Disallow: /, which asks that bot to stay off every page. Archived copies list 3 such names in November 2024 and 34 in November 2025, as our count of the file showed: 65 were added in a year, by our arithmetic.
By the name each bot carries, our count of the 99 finds 8 Google names, 4 Claude names, 3 OpenAI names (ChatGPT-User, GPTBot and OAI-SearchBot), 3 Meta names, 3 Grok or xAI names and 2 Perplexity names: 23 in all, about 23% of the list. Three more carry the Copilot name. Amazon blocked Meta’s Muse from its retail site in September, Reuters reported, as covered in our piece on Amazon’s plan against AI shopping agents.
Other doors closed in the same fortnight. By our count on 9 November, 15 companies and banks in our coverage restricted outside AI agents, the newest five UK banks. United’s website terms, updated on 11 November, now say no “Automated Agent” may use united.com or its app without its prior written permission. That makes 16 by our count, or 17 counting eBay, which appears to have blocked Muse, The Verge reported on 10 November.
Where the Agents Actually Bought
As we read it, Forter’s agent order data suggests store access matters as much as payment. Through 7 October, Forter says, Muse bought at 74% of the stores that received any agentic order, and ChatGPT Agent at 45%. Forter’s chart puts OpenAI’s Instant Checkout protocol at 24%, as our piece on the Forter data read it, so Muse reached about 3.1 times as many stores, by our arithmetic.
Forter gives the reason: scraping agents “can shop anywhere, while the protocols can only reach those stores that have integrated them”. As we read it, that is the agent that a robots file or a terms page can most easily turn away, and the one Amazon blocked.
Who Opened and Who Closed
The two lists overlap. Walmart is one of Sierra’s initial Poppy design partners and one of the three retailers in our count of firms restricting outside agents. Delta Air Lines is in Sierra’s list of more than 100 design partners, while United’s new terms bar automated agents from its own site.
As we read the pattern, stores that run their own agent or own a direct channel restrict outside agents, and the ones that join a protocol choose which agents reach them and on what terms. Our map of who owns product data for AI shopping agents sets out the layers between a brand’s listing and an agent’s checkout.
The Structural Read
As we read Forter’s data, the agent with the widest store reach, Muse at 74%, is the kind a robots file or terms page can turn away most easily, because it shops like a person clicking through a site rather than through an integrated protocol.
As we read Sierra’s list, protocols let a store choose which agents reach it: Walmart is a Poppy design partner and is also in our count of firms restricting outside agents, and Delta Air Lines joined Poppy as United barred automated agents.
Forter, AI agent order data, 2 November 2026
“They can shop anywhere, while the protocols can only reach those stores that have integrated them”
Three Implications
FOR AGENT MAKERSOpenAI’s page says websites need to ensure agents are not inadvertently blocked; three OpenAI names, including ChatGPT-User, are among the 99 that Amazon’s file bars, by our count.
FOR MERCHANTS Shopify has enabled Poppy for every merchant on its platform, Sierra says, and Muse looks for Poppy first on every site it visits.
FOR BANKS AND AIRLINES Our count of firms restricting outside agents rose from 15 on 9 November to 16 with United’s new terms, or 17 counting eBay’s apparent block of Muse.
The framework argues that “in any infrastructure transition, the entities that own the connective tissue underneath capture the economics regardless of which consumer-facing interface wins.”
As we read it, this week the card networks, which own that tissue, chose to let agents pay, while the stores that own the shelf chose which agents may shop. The framework predates ChatGPT Wallet and Poppy 1.0 and does not discuss them.
What Is Not Established
A robots.txt file is a request, not a technical block, and we did not test whether any agent can still reach amazon.com. We grouped bot names by the product name each carries; Amazon’s file does not say who operates them, and we did not check which user agent dots or Muse sends. OpenAI’s page does not name Amazon. Forter’s figures cover stores on its own network only.
Our count of firms restricting outside agents is limited to companies named in our coverage and is not a census. We did not contact Amazon, OpenAI, Meta, Sierra or Forter for this piece.
This Week In The AI Supercycle
AI Lost Its Central Banker, the Lab Oligopoly, and the Future of Open Source
This week’s issue: the Nvidia leadership change, read as the AI build-out losing its central banker: who now finances the GPU landlords, backstops the data centres and sponsors open models, and why two labs are becoming the bank.
In one week the card networks gave AI agents a way to pay, and Sierra’s protocol reached every Shopify merchant. Amazon’s file still bars 99 named bots, 23 of them carrying the names of six AI companies by our count, and our count of firms restricting outside agents rose to 16. Payment is now the open gate; access is the one each store keeps.
A note on sourcing. On 14 November we read OpenAI’s ChatGPT Wallet page, Forter’s agent order data, Sierra’s Poppy 1.0 post and Amazon’s robots.txt file, which we counted ourselves. The analysis draws on our earlier pieces linked above, each sourced to its own primaries. Counts, groupings and ratios are ours. This piece expands a pattern from our weekly issue for 7–13 November. We did not contact the companies for this piece.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
