Anthropic published a commerce agent blueprint, and by design none of it can place an order
Anthropic released a reference implementation for shopping and merchant agents on September 2, 2026, in the public repository anthropics/commerce-agents under the Apache 2.0 license. It carries a customer-facing shopping agent, a back-office merchant agent, four worked verticals and three runtimes, from the Messages API to Managed Agents in beta. Nothing in the code moves money: checkout is handed back to the host system, and every merchant write waits for a person to approve it. A companion post published the same day sets out the patterns behind the code, including cache hit rates Anthropic puts at 90 to 99 percent.
A shopping agent that can spend money is a liability, and the blueprint Anthropic published on September 2, 2026 is arranged so that it cannot. The repository anthropics/commerce-agents holds working implementations of two agents rather than a demo script, and each vertical can be tried in a guided demo before any code is written. A second post released the same day explains the design decisions underneath.
What is in the repository
The blueprint covers both sides of a transaction. One agent faces the customer and the other faces the person running the store, and they share configuration, memory and grounding code.
Anthropic says the code deploys where teams already build with Claude, naming the Claude API, Amazon Bedrock, Microsoft Foundry and Google Cloud Vertex AI. A Claude Code plugin scaffolds a custom agent from the same parts.
- A shopping agent for catalog search, comparison, planning, cart handling and order questions.
- A merchant agent for analytics, listing maintenance, inventory and order alerts, pricing and campaigns.
- Four worked examples: retail, travel, telecom and entertainment.
- Three runtimes: the Messages API, the Claude Agent SDK and Managed Agents, which is in beta.
The safety rule is in the structure, not in the prompt
The README states the limit plainly: nothing places an order, charges a card or changes a live listing. Checkout renders the cart for the host application to complete, and every merchant write is staged until a person approves it. Identifiers are validated against what the server issued before a write runs at all.
The companion post generalizes that into a rule any team can apply. No model tool call moves money or changes the business; the model's most dangerous action is to propose something, and approval routes through the maker-checker process a company already runs. That is a different claim from asking a model, in its instructions, to be careful.
The performance numbers are Anthropic's own
The announcement says retailers running shopping agents on Claude have seen carts up to 35 percent larger and shoppers 60 percent more likely to complete a purchase. No retailer is named, no method is described and nobody outside the company has repeated the measurement, so the figures are a vendor claim rather than a result.
The cache advice is more checkable and useful beyond commerce. Anthropic reports hit rates of 90 to 99 percent in the best deployments it has seen, and cached reads roughly 1.5 to 2 times faster at around 100,000 tokens. The method is to split a request into a global layer of system prompt and tool definitions, a session layer of user context and history, and a volatile layer for anything that changes mid-session.
„Nothing places an order, charges a card, or changes a live listing“
Sources
Related
OpenClaw 2026.9.2 turns Swarm on by default and makes sessions visible to other agents
The open personal assistant shipped 2026.9.2 on September 5, 2026, and two of its lines describe defaults rather than features. Swarm, which runs several sub-agents at once, is now on unless it is switched off, and session tools now show every session instead of only the calling agent's. The same release makes GPT-6 Astra selectable, applies most settings changes without restarting the Gateway, and moves plugin icons into the package. Plugin authors get a date: the deprecated prompt-context aliases become eligible for removal on or after September 8, 2026.
OpenClawverified
Claude Code 2.1.261 changes what Ctrl+W does and stops auto-approving diagram-renderer links
The release that landed on September 4, 2026 is mostly fixes, but four entries change behavior that was already there. The prompt's word-editing keys now match Bash, and the setting that used to select a keybinding style has no effect at all. Auto mode now treats a link that packs your content into a public diagram renderer's URL as an upload to that site, so it is no longer approved without you. Two new settings raise how much command output reaches the model inline, up to 128,000 characters.
Anthropicverified
GitHub Copilot switches GPT-6 Astra on by itself and leaves Claude Fable 5.1 off
GPT-6 Astra became generally available in GitHub Copilot on September 4, 2026, for the Pro+, Max, Business, and Enterprise plans. Claude Fable 5.1 reached the same four plans three days earlier. The two arrived with opposite administrator defaults: Astra is enabled automatically under default model enablement, while the Fable 5.1 policy is off until someone turns it on. Fable 5.1 is also the one that retains prompts and outputs, and the zero-retention exemption runs only to the end of the calendar year.
GitHubverified