On October 21 we sat in on a panel at Cloudflare Connect 2026 in San Francisco called “Getting your storefront agent ready for peak season.” Tulin Akdogan, Director and Strategic Industry Lead at Cloudflare, led it. Four people who keep large online stores running answered her questions.

The timing was pointed. Earlier this year Cloudflare reported that bots now request more web pages than people do, and its CEO put most of that growth down to AI agents browsing on someone's behalf. Peak season is a few weeks away. The panel was about what that shift means for a store.

Who was on stage

• Josh Mills, VP of Engineering at Gopuff. Gopuff delivers groceries and household goods in about 30 minutes from more than 400 warehouses in the US and UK. Josh runs site reliability, cloud engineering, warehouse IT and partner integrations, including Gopuff's recent ordering integration with xAI.
• Kristina Pototska, Product Management Director at Commerce. Commerce is the company behind the Commerce.com storefront platform, Feedonomics, which sends product catalogs out to other sales channels, and Makeswift, a visual site builder.
• Ross Harvey, Head of Infrastructure at Fruugo. Fruugo is a global online marketplace that connects merchants with shoppers in other countries. It grew on paid Google Shopping traffic, and Ross is leading its move toward shopping agents and Google's Universal Commerce Protocol.
• Justis Blasco, CTO and Co-Founder of Popmenu. Popmenu runs websites, marketing and online ordering for restaurants, across roughly 11,000 client domains.

Here is what they said, and what it means for a brand that sells online.

An agent cannot see your product photo

Kristina started with how shopping searches have changed. Nobody types two words into ChatGPT. They ask for running shoes with a wider heel and angled sides for ankle support. Almost no product description ever said that, because a person could look at the photo and see the shape. An agent works from the text. If the detail is not written down, the product does not rank lower. It is left out of the answer.

If a fact lives only in the photo, the agent never sees it.

Each team is closing that gap in its own way.

• Commerce fills in missing product details across merchant catalogs through Feedonomics, so an agent has more text to match against.
• Gopuff found holes in supplier data. It built an AI step that reads photos of nutrition labels and package backs, then writes the ingredients and nutrition facts out as text.
• Fruugo has to clean what merchants upload. Ross's example was a listing titled Candle Candle Relaxing Candle that was not a candle at all. Messy titles used to cost a little ranking. Now an agent skips the listing, and nobody notices until sales drop.
• Gopuff and Popmenu both talked about how pages are built. Many AI crawlers fetch the raw page. They do not run JavaScript or scroll, so anything that loads later is missing. Gopuff renders every product on a page, often more than 100, straight into the HTML for bots. Justis stressed clean HTML, proper labels for screen readers, and short text summaries, so an agent does not skip content or make it up.

A shopper who arrives from an AI chat runs into the same wall. The assistant told them something specific, and they scan the page to confirm it. If that fact sits inside an image or behind a tab, the person misses it too. We went through the common failure patterns in a third of retail product pages cannot be read by AI.

Nobody can see the prompt

In search, teams have Google Analytics and Search Console: impressions, rankings, clicks. Nothing like that exists yet for ChatGPT or Claude. A brand can find out it was named in an answer. It cannot see how often, or what the shopper typed first.

How the panel measures AI traffic today:

• Crawler reports. Commerce and Popmenu use Cloudflare's analytics to see which AI crawlers visit each day, from OpenAI, Amazon, Apple and Google, and how often a crawl turns into a click. Popmenu uses the same data to show restaurant clients that real AI assistants are getting through.
• Orders placed through agent tools. Commerce built tools that let an AI agent search products and check out through a standard connection called MCP. Because those orders come in through the tools, Commerce can tie each one back to an agent. Kristina said agent orders are already coming through in production. Cloudflare wrote up its WebMCP work with Commerce, which covers almost 100,000 storefronts.
• Referrals and sessions. Teams watch referral data from AI assistants and look at sessions from AI user agents, to see where bots land and where they leave.

Good bots and bad bots use the same front door

For years the security job was simple to state: block bots. Now blocking OpenAI's crawler can mean blocking a buyer. Meanwhile the bad bots got more aggressive. Fruugo handles about 15,000 requests a second, and most of it is bots that never buy. Josh said that when Gopuff creates a new subdomain, attack scanners find it within two minutes. They watch the public logs that list every new security certificate.

What works for them:

• Check that a bot is who it says it is. Cloudflare keeps a directory of verified bots, so a crawler that claims to be Googlebot or OpenAI has to come from that company's network.
• Catch scrapers posing as households. Many scrapers route through home internet connections so they look like shoppers. Gopuff gets 89% of its real orders through its app, so desktop web traffic gets a harder look. Working with Spur, Gopuff put challenges in front of traffic from these networks and cut 98% of the disguised scraping.
• Keep the door open for the crawlers you want. Prices, stock and listings change every day. Ross said Fruugo once limited Googlebot for four days, and sales dropped right away.

Agents can already check out

Panelists described testing live agents on real stores, from movie tickets in New York to Peruvian empanadas in Atlanta. The agents got through checkout, especially for small orders people repeat. Few people will hand an agent their card to buy a car or a sofa. A $50 weekly grocery restock or a Friday takeout order is a different matter. It is the next step after one-click ordering.

Agent checkout creates a fraud problem, though.

• Fraud checks assume a person. Tools like Forter look at browser and behavior signals to confirm a human is buying. An agent does not behave like one.
• Knowing the agent is not enough. Kristina's point was that a retailer needs more than the fact that ChatGPT placed the order. If the customer later disputes the charge, the store needs a reliable record that ties that customer to what the agent did.
• Standards are forming. The panel named MCP, WebMCP, Google's Universal Commerce Protocol, and agent payment work from card networks like Mastercard. Ross said a working MCP or UCP server takes an afternoon to prototype. The hard part is clean data and trust in who is buying.

Their predictions for a year from now

Tulin closed by asking each panelist what share of their orders will come through agents in 12 months.

• Gopuff, about 25%. Most Gopuff orders are quick needs placed in its own app, so Josh expects agents to show up mostly through voice assistants and scheduled restocks.
• Fruugo, more than 50%. Fruugo relies on outside search traffic rather than shoppers who come to it by name, so Ross expects over half of its volume to move to agent discovery and UCP.
• Popmenu, depends on the meal. Justis expects repeat orders, like the weekly family takeout, to move to agents. Finding a new restaurant and browsing a menu will stay with people.
• Commerce, steady growth led by the US. Kristina does not expect agents to replace the store website, in the same way mobile did not replace the web. As payment trust and European privacy rules settle, agents become another large channel next to the site.

What we took away

Every topic on the panel came back to the same thing. An agent acts only on what it can read, and a shopper who arrives from an agent checks only what they were told. The protocols are the quick part. As Ross put it, the endpoint takes an afternoon. The product data takes the season.

Three things to do before peak traffic arrives:

• Write down what the photo shows. Fit, shape, size, material and ingredients, as plain text on the product page and in the product feed.
• Fetch your own page the way a crawler does. Look at the raw HTML before any script runs, note what is missing, and fix your best sellers first.
• Watch the crawlers you want, not only the ones you block. Know which AI assistants visit, how often, and whether your security rules let them through.

The panel's open question was measurement. You can see that an agent visited. You cannot see why the person it sent left. eLLMo works on that second half. It sends simulated buyers matched to your customers through your product page and returns a ranked list of what stops people from buying, in their own words. AI Search shows how answer engines see your brand. For the wider picture of what AI search changed and what it did not, start with why your rankings held while organic traffic fell. For the season ahead, see Holiday 2026: one in five visitors will arrive from an AI chat.

*Related Links: How Commerce.com and Cloudflare are getting storefronts ready for AI agents (Cloudflare), Cloudflare CEO says AI bots now exceed human traffic on the web (Waxy), What makes an AI agent pick your brand, Your buyer is becoming an agent.*