The state of agent readiness
We sent a verified, signed AI shopping agent to 2,323 US online stores and asked three questions of each: can an agent read what you sell, can it get in, and can it reach checkout? Here is what it found.
This is the October 2026 edition. See the latest edition.
2,323 stores tested on October 24, 2026 · each store's most recent check
Five things the agent found
One store in four we tested is ready for an agent.
613 of 2,323 stores (26%) passed: an agent could read their products, get in without a challenge, and reach checkout or an agent checkout. Another 30% were partly ready. The rest (41%) were not ready. Stores we could scan averaged 60.2 out of 100.
The biggest retailers are the least ready.
None of the 100 largest US retailers passed. Those we could scan averaged 32.2 out of 100. 37% turned the agent away at the front door, against 7% of global brands’ US stores. Only 12 of the 115 web stores these retailers run reached even Partial.
The platform decides, and so far one platform has shipped.
607 of the 613 agent-ready stores run on Shopify, where 96% of the stores we tested publish an agent checkout. No store on Salesforce Commerce Cloud, Adobe Commerce (Magento) or WooCommerce passed. Most of those stores let the agent in (77% of Salesforce and 74% of Magento stores), but none offers an agent checkout. Today, an agent checkout comes almost entirely from the platform, not from individual merchants. It isn’t enough on its own: 43% of Shopify stores still fall short on other checks.
Where an agent connects from matters, and so does signing.
We re-checked 620 of the stores that blocked or limited the agent from a second location, a home internet connection. 347 turned automated shoppers away from both locations. 47 didn’t answer automated shoppers from either, and 7 more blocked from the cloud and didn’t answer from home. 42 let our agent in from the home connection but blocked it from cloud servers, which is where most shopping agents run. Signing cut both ways: on cloud servers, 87 stores let an unsigned request through but turned away the same request carrying our verified signature. From the home connection, that happened at only 2. Today, saying who you are doesn’t reliably earn an agent access, and from the cloud it can cost it.
Even open stores are hard to read.
Only 54% of stores publish product data an agent can read reliably (structured product markup with price and stock), and 47% advertise an agent checkout. A store can let an agent in and still leave it guessing what’s for sale and how to buy it.
From the giants to the long tail
We tested four groups of stores, built from public rankings. A store can appear in more than one group.
| Group | Stores | Agent-ready | Partial | Turned away at door | Agent checkout | Avg score |
|---|---|---|---|---|---|---|
| The largest retailers NRF Top 100 Retailers 2026 | 115 | 0% | 10% | 37% | 2% | 32.2 |
| Best-run online shops Newsweek America’s Best Online Shops 2025 | 496 | 15% | 27% | 25% | 27% | 51.3 |
| High-traffic long tail BuiltWith US e-commerce top sites, Semrush category leaders, marketplaces | 1,041 | 28% | 28% | 16% | 48% | 60.2 |
| Global brands’ US stores BuiltWith top 1M sites, filtered to stores | 696 | 36% | 37% | 7% | 65% | 69.6 |
| All stores | 2,323 | 26% | 30% | 16% | 47% | 60.2 |
What the store runs on
| Platform | Stores | Agent-ready | Share ready | Agent checkout | Avg score |
|---|---|---|---|---|---|
| Shopify | 1,071 | 607 | 57% | 96% | 82.2 |
| BigCommerce | 38 | 4 | 11% | 76% | 64.7 |
| WooCommerce | 40 | 0 | 0% | 0% | 58.5 |
| Salesforce Commerce Cloud | 264 | 0 | 0% | 0% | 50.8 |
| Adobe Commerce (Magento) | 115 | 0 | 0% | 0% | 48.1 |
| Other (Squarespace, Medusa) | 2 | 0 | 0% | 0% | 61.0 |
| Custom or undetected | 793 | 2 | 0% | 3% | 33.3 |
Average scores cover stores we could scan. Platform is detected from the store’s pages. Stores that block our agent show no pages to read, so they fall into “Custom or undetected,” which lowers that group’s scores.
What stops an agent at the 100 largest
For each of the NRF Top 100 Retailers, we tested its main US web store. None passed. This is the first thing an agent ran into at each.
| What the agent hit first | Retailers |
|---|---|
| Let agents in, but offer no agent checkout | 39 |
| Let agents in and offer an agent checkout, but fall short on other checks | 1 |
| Turn automated shoppers away at the front door | 27 |
| Open the front door, then block product pages | 22 |
| Don’t answer automated shoppers at all | 6 |
| Block agents that connect from cloud servers | 4 |
| Ask agents like ours to stay out (robots.txt) | 1 |
A handful of these retailers sell little or nothing online (fuel, convenience, members-only stores); they are included as listed. We don’t publish individual stores’ failing results; stores that pass are listed by name in the directory.
What moves a store to agent-ready
- Let verified agents through your bot protection. Blocks usually come from bot-protection settings. Allow verified bots and signed agents (Web Bot Auth), including those connecting from cloud servers.
- Ask your platform for an agent checkout. Every agent-ready store we found advertises an agent checkout protocol (UCP or ACP); fewer than 5% of not-ready stores do. If your platform doesn’t publish one, ask when it will.
- Publish product data agents can read. Structured product markup with price and stock on every product page.
- Link the basics from every page. Shipping, returns, contact, privacy and terms.
- Check where you stand. Scan your store free. It takes about a minute and tells you exactly what’s in the way.
Method
The agent. Every request carried a Web Bot Auth signature (RFC 9421 HTTP message signatures, Ed25519) pointing to our published key directory. Cloudflare lists our agent as a verified bot. It identifies itself as PegasusKYA in its user agent, honors robots.txt, makes at most 30 requests per store at one per second, reads only public pages, and sends no orders, carts or account actions. The only non-page request is a read-only catalog search, when a store advertises one. More about our agent.
The checks. Four checks, 25 points each. Found: sitemap, structured product data, price, stock, an agent manifest, linked policies. Admitted: home page and product pages open to the signed agent without a challenge. Checkout: an advertised agent checkout (UCP or ACP), and a cart and checkout an agent can reach. Trust: HTTPS, business identity in structured data, contact, privacy and terms pages, security.txt, and the store’s own signing keys. 85 or more is Agent-Ready, 60–84 Partial, under 60 Not ready. A store that challenges verified agents can’t be Agent-Ready however high it scores.
The stores. 2,345 US web stores from four public sources: the NRF Top 100 Retailers 2026 (each retailer’s main web stores), Newsweek’s America’s Best Online Shops 2025, BuiltWith’s US e-commerce top sites with Semrush category leaders and major marketplaces, and stores found among BuiltWith’s top one million sites. Non-store sites were removed by hand. 9 stores ask our agent to stay out and were not scanned, and 13 returned errors and were left out, leaving 2,323 stores tested.
The second location. Scans ran from Cloudflare’s network. 620 stores that blocked or limited the agent were re-checked from a US home internet connection, once with the same signed agent and once as an anonymous visitor.
Limits. A scan reads pages as a server sends them, before scripts run, which can understate stores built as JavaScript apps. Checkout detection looks at common addresses and advertised protocols, not every possible flow. Scores are a snapshot from October 24, 2026; stores change. Store groups come from public rankings, not a random sample of all US stores.
Cite as: PegasusKYA (Pegasus Source LLC), “The State of Agent Readiness,” October 2026, pegasuskya.ai/state-of-agent-readiness-2026-10.