Crossmint gave AI agents a way to buy from stores that never signed up, and Riskified started asking who sent them

On 8 October 2026 Crossmint launched Agent Commerce Toolkit, a developer kit that takes an AI agent from a saved card to a finished order at an online store through a single integration [1] [2]. Where a card qualifies, the toolkit pays with a tokenised credential from Visa Intelligent Commerce or Mastercard Agent Pay, which Crossmint describes as scoped virtual cards with expiry dates and spending limits [1] [2]. At checkout it picks Shop Pay, the Universal Commerce Protocol or, at a store that offers neither, browser automation on the ordinary checkout pages [1] [2].

The release adds that “merchants don’t need to add agent support” [1]. A shop that has never decided anything about agents can still receive agent orders, and the Agile Brand Guide’s roundup the next morning told marketing teams to settle the question with their security team before the holiday peak, since bot rules may block some of those orders [2]. Crossmint published no checkout success rate [2]. Alfonso Gómez-Jordana Mañas, a Crossmint co-founder, described the mess developers walk into: “One store has an API and the next has a bot check” [1].

Riskified scores the person behind the agent

Riskified announced Agent Identity Risk Intelligence the same day. It spots when an order or a customer service request comes from a personal AI assistant, links that assistant to a consumer identity and returns a risk signal in real time [3] [2]. Riskified names Meta’s Muse among the assistants it has in mind, and merchants will be able to set rules by agent type, approving low-risk agent orders automatically and sending high-risk refund claims raised by agents to a reviewer [3] [2].

Assaf Feldman, a Riskified co-founder and its chief strategy officer for technology, said: “A fraud ring can authorize an agent as easily as a loyal shopper can” [3]. The limited beta for enterprise merchants opens in December 2026, with general availability expected in 2027 [3] [2]. For this holiday season, then, merchants judge agent orders with the fraud tools they already run, as the Agile Brand Guide points out [2].

Newegg sells inside Gemini through Google’s protocol

Newegg took the opposite route and signed up. From 8 October, shoppers in the United States can buy eligible Newegg products inside the Gemini app and AI Mode in Google Search and pay with Google Pay without leaving the conversation [4] [2]. Newegg built the checkout on the Universal Commerce Protocol and stays the merchant of record, fulfilling and supporting every order [4] [2]. Ashish Gupta, who runs merchant shopping at Google, called it “a new milestone as we scale agentic commerce” [4]. The release gives no count of eligible products and no data-sharing terms [2].

ESMA tells EU crypto firms to drop unauthorised stablecoins

The European Securities and Markets Authority published an opinion on 8 October 2026 saying that crypto-asset service providers authorised under MiCA should stop offering EU clients any service involving stablecoins that do not comply with the regulation [5] [6]. The list covers trading platforms, exchange, order execution, advice, transfers, custody and portfolio management, and national regulators are asked to make firms stop clients from buying or adding to those tokens [5] [6]. ESMA named no token. The crypto.news report points to Tether’s USDT as the most visible case, because Tether has not obtained the relevant European authorisation [6].

Customers who already hold such tokens get a supervised exit. Firms may keep liquidating, converting, withdrawing, transferring or safekeeping them for a limited time, and national regulators should require the clean-up no later than three months after publication, which falls on 8 January 2027 [5] [6].