Everyone Else vs. Rufus: How Retailers Are Fighting Back

Last week we dug into how Rufus actually works. The short version: Amazon built a shopping agent that searches, recommends, and now buys things on your behalf—all inside its own walled garden. It influenced over $12 billion in sales last year. Competitors noticed.

As of early 2026, the retail landscape has fragmented into three distinct strategies to counter Rufus: building proprietary super-agents (Walmart), forming open alliances to share inventory (Google/Target), or explicitly banning external agents to protect their data (eBay).

The numbers make the urgency clear. Visa detected a 4,700% surge in AI-driven traffic to US retail sites in October 2025 alone. Morgan Stanley predicts nearly half of online shoppers will use AI shopping agents by 2030, accounting for roughly 25% of all spending. This is not a speculative trend. It is already reshaping how commerce works.

Here is a deep dive into the top retailers and merchants deploying Rufus-scale agents, the ones who decided to slam the door shut, and the security and trust problems that none of them have fully solved.

Walmart is the only physical retailer building a proprietary "brain" to rival Rufus directly. They are not licensing someone else's model and slapping a UI on top. They are building the full stack.

These retailers are building agents that go deeper into specific complex categories than a generalist like Rufus can manage. The strategy is not to match Rufus across the board—it is to be definitively better in one domain.

Most retailers cannot afford to build a Rufus from scratch. The model training, the inference infrastructure, the data pipeline—it is a billion-dollar project. So they joined forces.

The Universal Commerce Protocol (UCP) is an open standard unveiled at NRF 2026 in January, co-developed by Google with Shopify, Etsy, Wayfair, and Target. It has been endorsed by 20+ additional companies including Visa, Mastercard, Stripe, American Express, and Best Buy.

The philosophical difference from Rufus is clear. Amazon controls the whole stack. UCP distributes it. The bet is that an open ecosystem, even a messy one, can aggregate enough inventory to compete with Amazon's catalog.

Not every company fighting Amazon is a retailer. Some are building the infrastructure that lets everyone else compete.

In a notable move effective February 2026, eBay updated its User Agreement to explicitly ban external "Buy for Me" agents. They also updated their robots.txt to block crawlers from Perplexity, Anthropic, and Amazon—while notably allowing Google.

Underneath the retail strategies, a quieter but arguably more consequential battle is playing out: who defines how agents authenticate with merchants and process payments. There are now four major competing protocols, all launched between September 2025 and January 2026.

The technical approaches are genuinely different. Visa TAP centers on three capabilities: signaling agent intent (browse vs. buy), recognizing the consumer behind the agent, and transmitting payment credentials. It is available today on the Visa Developer Center.

Google's AP2 is more ambitious. Its three-mandate chain creates a cryptographic evidence trail specifically designed for dispute resolution. The Cart Mandate is co-signed by both merchant and consumer, locking exact items, price, and terms—creating a non-repudiable record. When an agent-placed order is disputed, there is a signed receipt showing exactly what was authorized.

Mastercard took a different approach, building on top of their existing tokenization infrastructure (the same tech behind Apple Pay and Google Wallet). Their Agentic Tokens require agents to be registered and verified before they can transact. Every player in the value chain—consumer, issuer, merchant—can recognize agent-facilitated transactions distinctly.

The race to deploy shopping agents has outpaced the security infrastructure to support them. The numbers are alarming.

JPMorgan Chase's global head of merchant services articulated the question everyone is asking: "Could the agent hallucinate and buy something we didn't tell it to buy?" If that happens, "the rules here are not fully formed yet."

When an AI agent makes a bad purchase, potential liability falls across five parties: the consumer who authorized the agent, the company that built it, the merchant who accepted the transaction, the payment processor, and now the AI platform itself—what the industry calls a "fifth player in the value chain." The existing four-party dispute model (consumer, issuer, acquirer, merchant) was not designed for this.

E-commerce took 10–15 years to develop mature dispute frameworks. Agentic commerce is attempting to build equivalent infrastructure in 1–2 years. Something will break.

Five strategies from five different types of companies. Four competing protocols. A security landscape that even OpenAI admits it cannot fully solve. A liability framework that does not exist yet. A few patterns worth calling out.

There Is No Single Winning Strategy

Walmart is building its own Rufus. Google is building an open protocol. Shopify is enabling the long tail. eBay is banning agents outright. Home Depot is going vertical. The fact that the responses are this different tells you the industry does not yet know what the right answer is. That is normal for early-stage platform shifts. What is abnormal is the speed—all of these launched within a six-month window.

Data Moats Matter More Than Model Quality

The agents that are most interesting are not the ones with the best language models. They are the ones with proprietary data. Walmart has grocery frequency data. Instacart has pantry history. Zalando has return-and-fit data. Home Depot has building codes. The model is commodity infrastructure. The data is the moat. This is why Amazon is hard to beat—it has the most comprehensive purchase history dataset in the world.

Open Protocols Create New Trust Problems

UCP is promising, but when Google's agent buys from Target on your behalf, who handles the dispute? Who owns the customer relationship? When an agent crosses platform boundaries, the authorization and verification questions multiply. This is the same principal-agent gap we flagged with Rufus's "Buy for Me," but at protocol scale. The protocol fragmentation makes it worse—four different ways to verify an agent means merchants need to support all of them or pick a winner.

Security Cannot Be an Afterthought

Visa's 450% increase in dark web "AI Agent" posts. OWASP's 73% vulnerability rate. OpenAI's admission that prompt injection may never be fully solved. Deloitte's $23 billion synthetic identity fraud projection. The threat landscape is real and it is growing faster than the defenses. Every retailer deploying a shopping agent is deploying an attack surface. The ones that treat security as a feature rather than a checkbox will have a meaningful competitive advantage.

Banning Agents Is Not a Long-Term Answer

eBay's approach makes sense for auctions. But for fixed-price listings, blocking agents means blocking a growing share of buying intent. As more consumers delegate shopping to agents, the platforms that refuse to work with them will see less traffic. The sustainable path is not banning agents—it is having a way to verify them, scope their authority, and resolve disputes when things go wrong.

The shopping agent race is not about who has the best chatbot. It is about who controls the commerce infrastructure—the data, the trust layer, the checkout flow, the dispute resolution.

Amazon built all of that internally. Everyone else is assembling it from parts. UCP handles inventory federation. Klarna handles data standardization. Visa TAP and Mastercard Agent Pay handle payment authentication. Google AP2 handles mandate capture. But the trust and verification layer—the part that tells a merchant this agent is authorized, this transaction is legitimate, this is who to call if something goes wrong—is still fragmented across competing standards with no unified answer.

Meanwhile, the security threats are scaling faster than the defenses. The liability frameworks do not exist. The regulatory environment is a patchwork of state laws, FTC enforcement actions, and an EU AI Act that does not fully take effect until August 2026.

That is the gap. And the longer it stays open, the more the market consolidates around the platforms that can solve trust internally—which is to say, Amazon. Every month without open trust infrastructure is a month where Amazon's walled garden gets more defensible.