Anthropic published a commerce agent blueprint, and by design none of it can place an order
Anthropic released a reference implementation for shopping and merchant agents on September 2, 2026, in the public repository anthropics/commerce-agents under the Apache 2.0 license. It carries a customer-facing shopping agent, a back-office merchant agent, four worked verticals and three runtimes, from the Messages API to Managed Agents in beta. Nothing in the code moves money: checkout is handed back to the host system, and every merchant write waits for a person to approve it. A companion post published the same day sets out the patterns behind the code, including cache hit rates Anthropic puts at 90 to 99 percent.
A shopping agent that can spend money is a liability, and the blueprint Anthropic published on September 2, 2026 is arranged so that it cannot. The repository anthropics/commerce-agents holds working implementations of two agents rather than a demo script, and each vertical can be tried in a guided demo before any code is written. A second post released the same day explains the design decisions underneath.
What is in the repository
The blueprint covers both sides of a transaction. One agent faces the customer and the other faces the person running the store, and they share configuration, memory and grounding code.
Anthropic says the code deploys where teams already build with Claude, naming the Claude API, Amazon Bedrock, Microsoft Foundry and Google Cloud Vertex AI. A Claude Code plugin scaffolds a custom agent from the same parts.
- A shopping agent for catalog search, comparison, planning, cart handling and order questions.
- A merchant agent for analytics, listing maintenance, inventory and order alerts, pricing and campaigns.
- Four worked examples: retail, travel, telecom and entertainment.
- Three runtimes: the Messages API, the Claude Agent SDK and Managed Agents, which is in beta.
The safety rule is in the structure, not in the prompt
The README states the limit plainly: nothing places an order, charges a card or changes a live listing. Checkout renders the cart for the host application to complete, and every merchant write is staged until a person approves it. Identifiers are validated against what the server issued before a write runs at all.
The companion post generalizes that into a rule any team can apply. No model tool call moves money or changes the business; the model's most dangerous action is to propose something, and approval routes through the maker-checker process a company already runs. That is a different claim from asking a model, in its instructions, to be careful.
The performance numbers are Anthropic's own
The announcement says retailers running shopping agents on Claude have seen carts up to 35 percent larger and shoppers 60 percent more likely to complete a purchase. No retailer is named, no method is described and nobody outside the company has repeated the measurement, so the figures are a vendor claim rather than a result.
The cache advice is more checkable and useful beyond commerce. Anthropic reports hit rates of 90 to 99 percent in the best deployments it has seen, and cached reads roughly 1.5 to 2 times faster at around 100,000 tokens. The method is to split a request into a global layer of system prompt and tool definitions, a session layer of user context and history, and a volatile layer for anything that changes mid-session.
„Nothing places an order, charges a card, or changes a live listing“
Sources
Related
Meta paused Muse sharing after researchers found more than 6,800 shared chats through DNS records
The security firm Claroc found that Muse built each shared conversation's web address from its title, and that passive DNS services recorded those addresses. Among the few hundred pages it opened were loan applications, internal revenue reports, and notes for a confidential call. Meta says sharing is paused while it reviews the findings.
Clarocverified
OpenCode says a breach hit 1.4% of Console users who had linked their own AI providers
OpenCode, the open-source coding agent, announced on October 17, 2026, that attackers had broken into its hosted Console service the night before. The project calls it a large-scale distillation attack and says it affected 1.4% of Console users, all of them people who had connected external providers. Co-founder Dax Raad says the open-source app itself was not involved. How the attackers got in has not been disclosed.
OpenCodeverified
OpenClaw 2026.10.5 blocks plugin hooks from changing tool calls after approval
OpenClaw's new release closes a gap that let an ordinary plugin hook alter a tool call after a trusted policy had already approved it. Such a call is now blocked unless the hook asks for its own approval, which breaks plugins that relied on the old order. The release also makes Gemini 4 Argon the default Google model and points the gemini alias at it.
OpenClawverified