The number that got our attention

During the 2025 US holiday season, traffic to retail websites referred by generative-AI tools rose sharply year over year, and Adobe found that AI-driven traffic surged across industries during the 2025 holiday season, with retail seeing the biggest jump, traffic up 693% year over year. Salesforce, tracking a separate and much larger panel of shoppers, put a number on what that traffic actually did: AI agents and other generative AI tools influenced more than 20% of all online retail sales globally during the holiday season.

Neither figure describes a future state. Both describe transactions that already happened, on infrastructure that already shipped, months before most e-commerce teams built a dashboard for it. The rest of this story is about what that infrastructure is, who built it, and what an operator can actually go check.

What has actually shipped

The most visible piece launched in late September 2025, when Stripe announced it is powering OpenAI's new commerce experience, Instant Checkout in ChatGPT, alongside the Agentic Commerce Protocol, a new open standard that enables programmatic commerce flows between AI agents and businesses. At launch, ChatGPT users in the US could buy from US Etsy sellers, with over a million Shopify merchants such as Glossier, Vuori, Spanx, and SKIMS coming soon. OpenAI's own numbers on reach are considerable: more than 700 million people turn to ChatGPT each week for help with everyday tasks, including finding products they love. By February 2026, the rollout had widened — Etsy sellers were live, over 1 million Shopify merchants including Glossier, SKIMS, Spanx, and Vuori were coming soon, and PayPal's ACP server was set to bring tens of millions of additional small businesses onto the platform in 2026. For merchants selling through Shopify, the economics are now public: OpenAI charges a 4% service fee on all completed transactions for Shopify merchants, with a 30-day free trial from the first qualifying order.

Amazon moved on a parallel track rather than joining OpenAI's protocol. Last February, it rolled out a shopping chatbot called Rufus, and in April it began testing an agent called Buy For Me that lets shoppers purchase some products from other websites without leaving its app. Adoption of the chatbot alone is now large: as of late 2025, approximately 250 million customers had used Rufus, and users who engaged with it were 60% more likely to complete a purchase.

Perplexity built its own agentic browser rather than a chat plugin. Its shopping feature Buy with Pro, launched in November 2025 in partnership with PayPal, allows users to complete purchases via one-click checkout directly within Perplexity's interface, using Comet's agentic capabilities to search for products and process transactions on behalf of the user.

The card networks did not wait to be asked. Mastercard Agent Pay is a payments framework, announced on April 29, 2025, that lets verified AI agents transact on a consumer's behalf using Agentic Tokens, introduced with Microsoft, IBM, and Braintree as launch partners. Visa followed with its own standard: Mastercard launched Agent Pay on April 29 and Visa announced Intelligent Commerce within a day of each other, with Visa's specific Trusted Agent Protocol following on October 14, 2025. Both networks then converged on a third, neutral standard — the September 16, 2025 launch of Google's Agent Payments Protocol (AP2) folded both networks into a shared mandate format, and both networks joined Google's AP2 protocol in September 2025.

The access fight underneath the protocols

Not every large retailer wants to be plugged into somebody else's agent. In November 2025, Amazon filed a lawsuit demanding Perplexity stop allowing its AI browser agent, Comet, to make purchases online for users, accusing Perplexity of committing computer fraud by failing to disclose when Comet is shopping on a real person's behalf, in violation of Amazon's terms of service. The dispute reached a first ruling in March 2026: a federal judge in San Francisco granted Amazon a preliminary injunction blocking Perplexity from using its Comet browser's AI agent to access password-protected sections of the Amazon website, finding that Amazon is likely to succeed on its claims that Perplexity violated the federal Computer Fraud and Abuse Act.

The ruling matters beyond the two companies involved. It establishes, for now, that a retailer can decide which agents are welcome at its own checkout — even when a shopper explicitly asked that agent to go there. Every operator building for agent traffic is implicitly making the same choice on a smaller scale, one robots.txt file and one API key at a time.

Read the growth numbers carefully

The holiday data holds up under scrutiny better than most viral growth statistics, but it comes with a scale caveat worth keeping in view. Even with triple-digit year-over-year growth, traffic to major U.S. retail websites driven by generative AI assistants surged sevenfold in just over a year, rising to 41 million monthly visits in December 2025 from nearly 6 million in October 2024, while still representing less than 1% of total retail traffic. The behavior of the shoppers who do arrive through an agent, however, looks different from ordinary traffic in ways that are harder to dismiss as a base-rate artifact. Independent analysis of actual Amazon sessions found that on Black Friday, Rufus-assisted sessions captured approximately 40% of total sessions but drove roughly 66% of purchases, converting at 3.5 times the rate of non-Rufus sessions — a gap that held steady across October, November and December.

None of this means agent-mediated shopping has replaced the search bar or the storefront. It means a small, fast-growing, unusually high-converting slice of demand now arrives pre-qualified by a model that already decided what to recommend before a human clicked anything.

What to check before agent traffic arrives

For an operator, none of this calls for a strategy memo. It calls for a short list of things to go verify directly, most of which take an afternoon rather than a quarter.

First, check whether your analytics already separate agent-referred sessions from ordinary organic and paid traffic — Adobe and Salesforce can only report aggregate industry numbers; only your own logs show what is happening on your domain. Second, check your robots.txt and any bot-management rules against the current list of commerce-relevant crawlers and fetchers, since a blanket block written in 2022 will silently exclude your catalog from every agent's retrieval pipeline without you noticing. Third, check whether your product feed is machine-readable in real time — price, stock, and variant data that is accurate for a human browsing a page but stale in the API a bot queries will simply be skipped. Fourth, check which of the competing protocols — OpenAI and Stripe's Agentic Commerce Protocol, Google's AP2, Visa's Trusted Agent Protocol, or Mastercard's Agent Pay — your existing payment processor or commerce platform already supports, since four agentic-commerce frameworks shipped between April and October 2025, from different layers of the stack, and are not mutually exclusive — most production agent-commerce flows in 2026 will touch two or more. Finally, decide deliberately, rather than by default, which agents you want transacting on your site and under what terms — the Amazon-Perplexity case shows that this is now a question with legal weight, not just a technical setting.