Meta Walmart and Stripe Just Wrote the Rulebook for Shopping Bots
Meta, Sierra, Walmart, Stripe, Shopify and others have announced the Personal Agent Protocol, an open standard letting AI agents authenticate with businesses and complete tasks on a customer's behalf, arriving as surveys show most Americans still don't trust AI to make purchases for them.
The companies building AI shopping agents just admitted the technology has a trust problem bigger than any single product can fix. On October 6, Meta and Sierra announced the Personal Agent Protocol, an open standard joined by Walmart, Stripe, Shopify, Genesys, Instinct and Rocket, designed to let AI agents prove who they're acting for before a business lets them do anything.
Sierra co-founder and OpenAI chairman Bret Taylor framed the core problem bluntly: "It is kind of chaos until such a standard exists" — businesses currently have no reliable way to know whether they're dealing with a real person or an AI acting on someone's behalf. A few details define how the protocol is actually structured:
- Authority splits between customer and business — the customer decides whether their agent gets read-only or write access, while each company sets what actions its own agents can take
- Meta's David Singleton compared the ambition to email: "it works great because it is a standard that everyone can use to talk to each other"
- A v0.1 specification is due this month, with the protocol working across regular websites, software interfaces, or direct business-to-business agent conversations
The launch isn't happening in a vacuum, though — Stripe and Shopify are already members of a rival standard, Visa's Trusted Agent Protocol, built with Microsoft and Worldpay, meaning two of the biggest names backing this new effort are simultaneously hedging their bets elsewhere.
Trust remains the real bottleneck either way: WSJ data cited in coverage of the announcement found just 3% of US adults currently trust AI agents to complete purchases on their own, with a third saying they'd never allow it.
Notably, no European retailer, bank or payment company has joined yet, and the protocol currently has no carve-out from the EU's strong customer authentication rules — a gap that could limit how far "the rails for agentic commerce," as Singleton called them, actually extend before regulators weigh in.
