#BlinkTank: Shopify turns any AI agent into a personal shopper
It's been an interesting week in terms of AI discovery. Shopify has launched shop.md, which lets you turn ChatGPT, Claude or any other AI agent into a personal shopper that searches every Shopify store and pays with Shop Pay. Two days later Google launched Universal Cart in the US, which lets you find a product in Search or Gemini and pay for it with Google Pay without ever visiting the store. Both are being launched in the US first, and in both cases the sale can happen away from your website, on the strength of your product data alone.
Elsewhere, a spate of checkout hijacks has hit Shopify stores through third-party apps. Hacking and phishing attempts have been pretty rare on Shopify compared to other platforms, so it's interesting that we're now starting to see an upturn, and AI is likely to make this a much bigger challenge from here on in. Meta also has a deadline for you on 28 October, and Google has tightened up on fast-moving prices in Merchant Center.
On to the news!
Shopify turns any AI agent into a personal shopper
On 13 October Shopify launched shop.md for shoppers and shop.dev for developers. The shopper part is simple. You add the Shop skill to whichever agent you already use, whether that's ChatGPT, Claude or anything else that supports MCP, connect your Shop account, and describe what you want in plain English.
The agent then searches Shopify Catalog, which Shopify says has more than a billion products, reads the options, prices and stock, builds a cart and opens checkout with the merchant, paying through Shop Pay once you've confirmed the total. Tobi Lütke's summary was "Turn any existing Agent into the world's best personal shopper for you."
Underneath it is Shop MCP, a single server Shopify runs that any developer can plug into for search, sign-in and checkout. Until now agents reached Shopify's catalogue through named partnerships with OpenAI, Perplexity and Meta, so this is the point where it opens to everyone.
There's also a command-line tool (npm install -g @shopify/shop, then shop search followed by whatever a customer would type) that returns the same results an agent sees. That is the useful bit for merchants, because you can ask for things the way your customers do and see what comes back.
What the agent sees is your product data, nothing else. If you want to be found, fill it in, and start with the category. Shopify excludes anything it classes as uncategorised from the Catalog altogether, and while it reads the category you set in admin, it also checks it against your title, description and images and makes its own decision. So set it on every product, and make sure the rest of the listing is consistent.
🔗 Shop MCP (shop.dev)
🔗 Shopify Catalog requirements (Shopify Help Center)
Google launches Universal Cart so shoppers can pay without visiting your store
Universal Cart went live in the US on 15 October. The thing to understand is that a shopper can now find your product in Google or Gemini and pay for it with Google Pay without ever visiting your store. Nike, Sephora, Target, Walmart and Wayfair are in, and so, in Google's words, are "many Shopify merchants".
That last bit is important because Shopify switched eligible stores on automatically from 18 September. If you sell in the US, check Merchant Center to see whether you're live and decide whether you want to be (and I imagine nearly everyone will), because you can turn it off easily. You stay the seller of record either way, so returns and customer service are still yours.
Where this goes next is fascinating. Google now holds the basket, the cards and the promo codes, and watches prices in the background, which is everything it needs to let Gemini buy on someone's behalf. It already does a version of that in price tracking.
🔗 Google's new Universal Cart launches today in the U.S. (Google Blog)
Checkout hijacks arrive on Shopify through third-party apps
Shopify stores have historically seen far less hacking and phishing than other platforms, partly because the checkout is so locked down, so it's interesting that we're now starting to see an upturn. Over the past week shoppers on a number of stores have been redirected from checkout to fake payment pages, and the common thread is two apps, Swym Wishlist Plus and HulkApps Product Options, that load code into your storefront from their own servers.
Neither Shopify nor Swym has said anything official yet, so treat the detail as developer reports rather than confirmed. HulkApps says it has fixed it. If you have either app, test checkout in a fresh private window a few times (the code is reported to fire once per session, so once is not enough), and consider switching the app embed off in the theme editor until there's a clear statement.
The weak point here is not Shopify, it's the apps, and most stores run dozens of them. AI is making this kind of attack cheaper to build and quicker to adapt, so I'd expect app security to be one of the bigger problems the platform has over the next couple of years. An app audit before peak is not a bad idea.
🔗 Swym status page
🔗 Checkout phishing redirect thread (Shopify Community)
Meta will switch on product browsing for existing ads on 28 October
Continuing this week's theme of shopper behaviour moving away from the storefront, from 28 October a click on your existing Facebook or Instagram ad may open a product page inside Meta, with suggested items, before the shopper ever reaches your site.
Meta is switching this on for ads that are already running unless you opt out, and the setting lives in the Advantage+ creative and destination options, per ad, so it can be turned off again at any time.
Meta says it saw 3% more conversions on average in an August test, which is of course its own number and should be taken with a large pinch of salt. The thing to watch is measurement, because Meta clicks and site sessions will diverge part of the journey happens inside the app.
🔗 Meta will turn on product browsing in existing ads on 28 October (Relevant Audience)
Merchant Center warns that fast price changes may cause disapprovals
If your prices or stock change more than about once a day, Google may start disapproving those products rather than updating them. That's the gist of a change to the Merchant Center help page on automatic item updates, now called automations, which also says Google may switch the automation off altogether if too many mismatches build up. For frequent changes it now points you at the Merchant API.
The change appears to date from the end of September and was picked up in early October, and Google didn't announce it separately. Stores running dynamic pricing or fast-moving stock should check how often their feeds update against what the product page shows, particularly before Black Friday.
🔗 Allow Merchant Center to update product information automatically (Google Merchant Center Help)
Looking for work
Fatemah Jamal Al-Lail has spent the last three years at the fashion brand WYSE London working, covering CRO, personalisation, AI and the digital product integrations that hold an ecommerce stack together. She's now looking for her next brand-side role and is also open to consultancy projects in the meantime.
If you are hiring and the role fits someone with large-catalogue Shopify experience, or you are looking and have that background, send me a message.
Partner shout-out: Addingwell
Tracking is something that just keeps getting more and more complex. Our default recommendation for server-side tracking for some time has been AddingWell. We've worked with them across a number of our clients and I wrote a piece for them earlier this year on what server-side tracking does to organic revenue reporting, which is the first thing I send people when they ask why their GA4 numbers look low.
🔗 Addingwell
🔗 Server-side tracking and organic revenue on Shopify (Addingwell)
As ever, thanks for reading. If you found this useful, forwarding it on to someone else who runs or works on a large-catalogue Shopify store helps us more than just about anything.
See you next week.
Sam
Who am I and what does Blink do?
I'm Sam Wright, Managing Director and co-founder of Blink SEO. We're a search marketing agency that works exclusively with large-catalogue Shopify stores - the kind where the challenge isn't just visibility, but helping customers find the right product in the first place.
We specialise in SEO and PPC for merchants managing hundreds or thousands of products. Most of our work starts with taxonomy: how a store is structured and categorised, and what that means for organic performance, paid efficiency, and on-site discovery.
If you found this useful and aren't already subscribed, you can sign up at blinkseo.co.uk/blinktank.
If you run a large-catalogue Shopify store and want to talk about organic or paid performance, reply to this email or find me at blinkseo.co.uk.