# Only 1 in 10 Will Let an Agent Buy. Commerce Surfaces Still Score 0 of 5. Mastercard Encoding Trust: only one in ten will let an agent finish a purchase. Verifiable Intent is shipping. Live scans: google 22, walmart 26, shopify 24 — all commerce 0/5; network AI 22.67%, referrals still 0. Canonical: https://robauto.ai/blog/one-in-ten-agent-buy-commerce-still-0-of-5 Robauto Team · Published Oct 1, 2026 · Last updated Oct 1, 2026 Mastercard Encoding Trust: only one in ten will let an agent finish a purchase. Verifiable Intent is shipping. Live scans: google 22, walmart 26, shopify 24 — all commerce 0/5; network AI 22.67%, referrals still 0. **Only one in ten consumers is willing to let an AI agent complete a purchase on its own.** That figure comes from Mastercard’s July 2026 _Encoding Trust_ report — and it is the binding constraint on agentic commerce, not model quality. Trust rails like Verifiable Intent are shipping. On the merchant open web, Agentic Commerce discovery is still mostly empty. ## **What Mastercard’s trust stack is saying** Mastercard Foundry’s [Encoding Trust](http://innovationinsights.mastercard.com/encoding-trust) report (July 2026) puts the gap in plain numbers: - Consumers are open to AI-assisted discovery and research, but **only one in ten** will let an agent finish the buy autonomously - In a 26,000-respondent multi-country study, openness falls as autonomy rises: collaboration is common; independent purchasing is rare - Financial institutions overwhelmingly name **trust** as the top barrier; **78%** expect fraud to rise significantly with agentic commerce - Mastercard research cited in the report finds **over two thirds** of consumers do not yet trust agentic AI, with security, privacy, and control leading concerns - Agent-mediated transactions are still tiny relative to the forecast: about **0.4%** of global ecommerce volume and **0.2%** by value today, against a $3–5 trillion 2030 consumer forecast the report references Separately, Mastercard and Google open-sourced [Verifiable Intent](https://verifiableintent.dev) — a standards-based, cryptographic record of what a cardholder authorized an agent to do, aligned with AP2 and UCP and designed to be protocol-agnostic. The public draft explains the shift: from “who are you?” at checkout to “who are you, and who authorized this agent, under what constraints?” Identity, intent, and action become a tamper-evident chain merchants and issuers can check. That is the payments-side trust layer. Brands still have to publish machine-readable commerce surfaces those agents can discover. ## **Live Agent Scans, October 1, 2026** We ran fresh Robauto [Agent Scans](https://robauto.ai/scan) this morning (25 read-only checks, score 0–100). Agentic Commerce covers x402, ACP, UCP, AP2, and MPP: DomainScoreSignalTechIntegrationCommerceSource mastercard.com **blocked** (403 bot interstitial) — — — — [Agent Scan](https://robauto.ai/scan?url=mastercard.com) google.com **22** 3 / 6 0 / 4 0 / 10 **0 / 5** [Agent Scan](https://robauto.ai/scan?url=google.com) walmart.com **26** 3 / 6 0 / 4 0 / 10 **0 / 5** [Agent Scan](https://robauto.ai/scan?url=walmart.com) shopify.com **24** 6 / 6 0 / 4 0 / 10 **0 / 5** [Agent Scan](https://robauto.ai/scan?url=shopify.com) robauto.ai **98** 6 / 6 4 / 4 9 / 10 **5 / 5** [Agent Scan](https://robauto.ai/scan?url=robauto.ai) metareva.com **100** 6 / 6 4 / 4 10 / 10 **5 / 5** [Agent Scan](https://robauto.ai/scan?url=metareva.com) Google co-develops UCP and Verifiable Intent. Walmart and Shopify sit in the UCP partner story. On these public marketing domains today, the Agentic Commerce tier is still **0 of 5** — no ACP, UCP, x402, AP2, or MPP discovery documents the scanner can read. Mastercard.com’s own trust pages return a bot-management interstitial to a read-only scan (a legitimate ops choice, and a decision about agent visibility). Ceiling examples publish the full stack, including commerce discovery at **5 of 5**. ## **Network pulse: agents crawl; referrals stay at zero** From live [Robauto AI Search Data](https://robauto.ai/ai-search-data) (updated hourly): MetricValueSource Total page views (90d) **1,324,157** [AI Search Data](https://robauto.ai/ai-search-data) AI-classified views (90d) **300,136** [AI Search Data](https://robauto.ai/ai-search-data) AI traffic share **22.67%** [AI Search Data](https://robauto.ai/ai-search-data) ai_referral visits **0** (0%) [AI Search Data](https://robauto.ai/ai-search-data) llm_crawler share of bot traffic **53.4%** (160,315 visits) [AI Search Data](https://robauto.ai/ai-search-data) Agent Readiness Index median **20** / max **75** (79 scored, 20 blocked of 99 attempted) [Agent Readiness Index](https://robauto.ai/agent-readiness-index) Only `llm_crawler` + `ai_referral` count as AI search in Robauto’s taxonomy. Classic search bots never inflate that share. Trust papers and open specs raise the ceiling for autonomous buying — but measured AI referrals across the network are still **zero**, and the readiness median remains **20**. ``` `{ "as_of": "2026-10-01", "thesis": "trust_rails_ship_merchant_commerce_surfaces_lag", "mastercard_encoding_trust": { "autonomous_purchase_willingness": "1_in_10", "source": "http://innovationinsights.mastercard.com/encoding-trust" }, "verifiable_intent": { "spec": "https://verifiableintent.dev", "aligned_with": ["AP2", "UCP"] }, "ai_search_90d": { "total_page_views": 1324157, "ai_agent_views": 300136, "ai_traffic_percentage": 22.67, "llm_crawler_visits": 160315, "ai_referral_visits": 0 }, "readiness_index": { "median": 20, "max": 75, "scored": 79, "blocked": 20 }, "example_scans": { "mastercard.com": "blocked_403", "google.com": {"score": 22, "commerce": "0/5"}, "walmart.com": {"score": 26, "commerce": "0/5"}, "shopify.com": {"score": 24, "commerce": "0/5"}, "robauto.ai": {"score": 98, "commerce": "5/5"}, "metareva.com": {"score": 100, "commerce": "5/5"} } }` ``` ## **What brands should ship while trust rails land** Issuers and networks are building verifiable intent, scoped tokens, and agent identity. Merchants still win or lose on whether an agent can find ACP/UCP discovery, an MCP or A2A card, and honest product data without a human pasting a URL. Publish Signal Basics first (robots, sitemap, llms.txt, readable HTML), then Agent Integration, then Agentic Commerce. Run a free [Agent Scan](https://robauto.ai/scan) on your domain. Guides live on [Robauto Learn](https://robauto.ai/learn); watch crawls vs referrals on [AI Search Data](https://robauto.ai/ai-search-data). ## Sources - [Mastercard Foundry — Encoding Trust (July 2026)](http://innovationinsights.mastercard.com/encoding-trust) - [Verifiable Intent — open specification](https://verifiableintent.dev) - [Mastercard — How Verifiable Intent builds trust](https://www.mastercard.com/us/en/news-and-trends/stories/2026/verifiable-intent.html) - [Robauto AI Search Data](https://robauto.ai/ai-search-data) - [Agent Readiness Index](https://robauto.ai/agent-readiness-index) - [Agent Scan — mastercard.com](https://robauto.ai/scan?url=mastercard.com) - [Agent Scan — google.com](https://robauto.ai/scan?url=google.com) - [Agent Scan — walmart.com](https://robauto.ai/scan?url=walmart.com) - [Agent Scan — shopify.com](https://robauto.ai/scan?url=shopify.com) - [Agent Scan — robauto.ai](https://robauto.ai/scan?url=robauto.ai) - [Agent Scan — metareva.com](https://robauto.ai/scan?url=metareva.com) - [Robauto Agent Scan](https://robauto.ai/scan) - [Robauto Learn](https://robauto.ai/learn) ## Where can an agent get this data live? **Robauto MCP — Agent Intelligence & Brand Discovery Infrastructure.** A public, stateless Streamable HTTP endpoint at `https://mcp.robauto.ai/mcp`, callable with no key. Setup and the full tool list are in the [Robauto MCP directory](https://robauto.ai/mcp-directory). [All blog posts](/blog) --- (c) 2026 Robauto, Inc. — support@robauto.ai Machine surfaces: https://robauto.ai/llms.txt · https://robauto.ai/llms-full.txt · https://robauto.ai/.well-known/api-catalog