Anthropic open-sourced the shopping loop. Merchants still own the chargeback.

On September 2, 2026, Anthropic released Claude Commerce Agents: an Apache-2.0 blueprint with a customer-facing shopping agent, a staff-facing merchant agent, four vertical demos (retail, travel, telecom, entertainment), and a Claude Code plugin. It is scaffolding, not a storefront. Payments, identity, authorization, and live writes stay with the operator.

That split is the story. The repo can get a team from “we should have an agent” to a local demo in hours. It does not move liability off the merchant of record.

What actually shipped

The shopping agent lives inside the merchant’s app or site. It searches the catalog, handles multi-item asks, compares options, builds a cart, and answers order and returns questions in the same thread. It is meant to hand that cart to the store’s existing checkout — Shop Pay, the merchant’s PSP, or an agentic payments provider — not to become the payment rail.

The merchant agent works for the people running the store. It can answer what is selling, flag inventory that will stock out before a promo, draft pricing and campaigns, and stage listing changes. By default, a person approves anything that goes live.

Anthropic’s own framing is explicit: Claude is the intelligence layer, not the catalog, not checkout, not the last mile. There is no paid placement inside the agents you build. The repository is a reference implementation. Anthropic says it will not maintain it as a product or accept outside contributions. You fork it and own the result.

Retailers already running shopping agents on Claude have reported carts up to 35% larger and shoppers about 60% more likely to complete a purchase. Treat those as vendor-cited outcomes from deployed agents, not as a guarantee that cloning the repo produces the same lift.

Why checkout risk does not travel with the code

An agent can get a shopper most of the way to a buy. The last stretch — payment, identity, confirmation — is still a trust-delegation problem. Most systems still expect a human to authenticate, pass 3-D Secure, or tap a wallet. An agent cannot do that without credentials and a mandate the merchant can later defend.

When the agent is on your store and checkout stays yours, you remain merchant of record. That is the good news: you keep the customer record, fulfillment, refunds, and support. It is also the risk: chargebacks, fraud, tax, regulated goods, and “the agent bought the wrong thing” still land on you. No rail has fully settled who is liable when an authorized agent executes a purchase the buyer later disputes. Until that settles, a signed audit trail is the asset that matters in a fight.

Two failure modes sit above the card number:

• Over-scoped authority. The agent can act beyond what the shopper meant.
• Manipulated context. Catalog data, tool results, or injected instructions shape the cart before anything is signed. A valid checkout signature does not prove the pre-sign context was clean.

Anthropic’s harness tries to contain the first problem: the consumer agent is not supposed to invent a price or a product; cart and refund authority have hard limits; anything past those limits escalates to a person. Those are patterns in the blueprint. They become real only if you keep them wired to your catalog, your policy engine, and your approval UI.

What the blueprint is for — and what it is not

A first-party commerce agent on your domain is different from an external agent that reads your catalog from ChatGPT, Gemini, or Copilot. The first keeps brand and checkout. The second can own the interface. Both can move GMV. Only the first keeps the conversation on your property — if you actually ship support, order status, and returns in that same thread instead of bouncing the shopper to a help center.

Ship it without inheriting a silent payment bot

1. Fail closed on money. Search and compare can be autonomous. Add-to-cart can be autonomous if inventory is real. Charge, refund, address change, and account write need a person or a narrowly scoped, signed mandate.
2. Bind the cart to live systems. Prices and availability must come from tools, not from the model’s memory. If the tool is stale, the agent will sell fiction.
3. Keep guest checkout and cart deep links. Forced account creation and CAPTCHA walls are the most common hard stops for agent-assisted checkout. Distinguish authorized agents from scrapers; do not treat every bot as fraud.
4. Log intent, not just the charge. Store the prompt, tool results, cart snapshot, policy version, and who approved the write. That packet is what you will need when a buyer says they never asked for the extra SKU.
5. Cap blast radius. Per-session spend caps, SKU denylists, and “no live write without approval” on the merchant agent are more important than a prettier chat panel.

Who should fork it this week

Teams that already have a working catalog API, checkout, and support stack. The blueprint compresses the agent loop, UI tools, and guardrail patterns. It does not replace PCI scope, KYC, or your chargeback playbook.

Teams hoping Anthropic will run commerce for them should read the license and the FAQ again. The code is free. The risk stays on the merchant. That is the design, not a gap they forgot to close.