Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
IT Security NachrichtenIP Fabric 8.1 adds application-aware mapping and cloud-native data model(24.09.2026 um 19:52 Uhr)
•
IT Security NachrichtenExposed GitLab project email addresses let attackers push code(24.09.2026 um 19:47 Uhr)
•
IT Security NachrichtenIntegration von Luft- und Flüssigkeitskühlung - Netzpalaver(24.09.2026 um 14:20 Uhr)
••
IT Security NachrichtenNeu: Saferinternet.at-Seite für Schulen - Onlinesicherheit(24.09.2026 um 15:08 Uhr)
•
IT Security NachrichtenWarum jeder KI-Agent als privilegierter Nutzer gelten muss - it-daily(24.09.2026 um 15:24 Uhr)
••
IT Security NachrichtenDie Cybersicherheit der Schweiz durch Kooperation stärken(24.09.2026 um 17:10 Uhr)
••
IT Security NachrichtenAlert Fatigue - Wenn der Alarm zur Gewohnheit wird(24.09.2026 um 17:23 Uhr)
•
IT Security NachrichtenIP Fabric 8.1 adds application-aware mapping and cloud-native data model(24.09.2026 um 19:52 Uhr)
•
IT Security NachrichtenExposed GitLab project email addresses let attackers push code(24.09.2026 um 19:47 Uhr)
•
IT Security NachrichtenIntegration von Luft- und Flüssigkeitskühlung - Netzpalaver(24.09.2026 um 14:20 Uhr)
••
IT Security NachrichtenNeu: Saferinternet.at-Seite für Schulen - Onlinesicherheit(24.09.2026 um 15:08 Uhr)
•
IT Security NachrichtenWarum jeder KI-Agent als privilegierter Nutzer gelten muss - it-daily(24.09.2026 um 15:24 Uhr)
••
IT Security NachrichtenDie Cybersicherheit der Schweiz durch Kooperation stärken(24.09.2026 um 17:10 Uhr)
••
IT Security NachrichtenAlert Fatigue - Wenn der Alarm zur Gewohnheit wird(24.09.2026 um 17:23 Uhr)
•
Intelligence View
⚡ tsecurity.de Intelligence

A Retailer's Guide to AI Shopping Protocols: ACP, UCP, and MCP Explained

Three protocols are going to determine whether your products can be sold through ChatGPT, Google AI Mode, and Perplexity over the next few years. Most retailers I talk to haven't heard of any of them, and that ignorance is going to cost…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Three protocols are going to determine whether your products can be sold through ChatGPT, Google AI Mode, and Perplexity over the next few years. Most retailers I talk to haven't heard of any of them, and that ignorance is going to cost them.



ACP (Agentic Commerce Protocol) is OpenAI and Stripe's standard for checkout inside ChatGPT. UCP (Universal Commerce Protocol) is Google's open standard for purchases inside AI Mode and Gemini, backed by over 60 organizations. MCP (Model Context Protocol), originally from Anthropic and now governed by the Linux Foundation, is the infrastructure layer that lets AI agents connect to any commerce system. Together, these three protocols define how products get discovered, carted, and purchased through AI assistants.



One thing I learned from building commerce infrastructure: when new protocols emerge, the companies that implement early get structural advantages that are very hard to close later.



We're at that moment in commerce right now. So let me break down what ACP, UCP, and MCP actually do, who's behind each one, and what you should be doing about them today.






What Problem Do These Protocols Solve?



Right now, if you want to sell through an AI assistant, there's no standard way to do it. Every platform has built its own approach. ChatGPT has one way of handling product discovery and checkout. Google has another. Perplexity has a third.



For retailers, this creates an ugly situation. Imagine if, in 2005, every search engine required a completely different format for your website. That's roughly where AI commerce is today. Companies like Paz.ai are working on unified integration layers to help retailers avoid building separate implementations for each protocol, but the underlying standards are what make any of this possible.



These three protocols are the industry's attempts to standardize how AI agents discover products, manage carts, process payments, and complete purchases. They come from different companies with different philosophies, and they overlap in some areas while being complementary in others.






What Is ACP (Agentic Commerce Protocol)?



ACP (Agentic Commerce Protocol) is the standard created by OpenAI and Stripe that enables AI assistants to handle the entire checkout process on behalf of a shopper.



OpenAI and Stripe built ACP, with Shopify as a key launch partner. When someone asks ChatGPT "order me that coffee maker we talked about," ACP is the protocol that enables ChatGPT to find the product, add it to a cart, process the payment through Stripe, and confirm the order. The shopper never visits a website.



The defining feature of ACP is anonymous, frictionless checkout. The buyer doesn't need to create an account on your site or enter their shipping address into your checkout flow. Stripe handles the payment, and the retailer receives the order with customer details attached.



Who's using it right now:





  • Instacart was one of the first to implement full ACP checkout in ChatGPT, letting users order groceries through conversation


  • Shopify has enabled ACP across its platform, which means over a million merchants have potential access. Shopify takes a transaction fee on ACP-based sales


  • Target has been running a beta with multi-item cart support


  • Etsy activated ACP for all U.S. sellers


  • PayPal announced ACP integration rolling out in 2026



What it means for you: To sell products through ChatGPT today, retailers need ACP integration. If you're on Shopify, you likely already have baseline ACP access. If you're on another platform, you'll need ACP integration through middleware or a multi-protocol commerce platform. With 900 million weekly ChatGPT users (per OpenAI's confirmed figures), this channel is already generating measurable transaction volume for early adopters.






What Is UCP (Universal Commerce Protocol)?



UCP (Universal Commerce Protocol) is Google's open standard that enables purchases directly inside Google AI Mode and Gemini search results.



Google built UCP with backing from over 60 organizations including major payment networks, commerce platforms, and global retailers. When someone uses Google's AI search to research a product and the AI shows a "Buy" button right in the results, UCP is the protocol handling that transaction behind the scenes.



The defining feature of UCP is discovery-first commerce. It's designed to work within the context of search and research, turning product exploration into direct purchasing. Google announced UCP supports six core capabilities: product discovery, cart management, identity linking (via OAuth 2.0), checkout, order management, and extensible vertical-specific modules.



Who's using it right now:





  • Etsy and Wayfair were the first live UCP partners


  • Shopify, Target, and Walmart are in the pipeline for UCP integration (per Google's announcements at their digital advertising events in early 2026)

  • Google has also launched "Direct Offers" in AI Mode, which lets merchants surface promotions and deals directly in AI-generated search results



What it means for you: If organic search through Google is a significant channel for your business (and for most retailers, it is), UCP is how you maintain relevance as Google shifts from blue links to AI-generated shopping experiences. Research from Semrush analyzing tens of millions of AI search sessions found that over 90% of AI-generated responses produce zero clicks to external sites. If your products can't be purchased inside AI Mode, they may simply not get purchased at all.






What Is MCP (Model Context Protocol)?



MCP (Model Context Protocol) is a platform-neutral communication standard that enables AI agents to connect to external commerce systems, inventory databases, and payment processors.



Originally created by Anthropic (the company behind Claude), MCP is now donated to the Linux Foundation's Agentic AI Foundation. It was co-founded by Anthropic, Block, and OpenAI, with support from Google, Microsoft, AWS, Cloudflare, and Bloomberg.



MCP is the connectivity layer that lets AI agents talk to external tools and services. It standardizes how AI agents connect to external services the way REST APIs standardized web service communication a decade ago. It doesn't handle the shopping experience directly, but it provides the plumbing that lets an AI agent connect to your inventory system, check real-time pricing, verify stock levels, or process a return.



Where ACP and UCP handle the consumer-facing checkout, MCP operates at the infrastructure level. It's what enables an AI agent to pull your product catalog, check whether an item is in stock at a specific warehouse, or initiate a payment through a connected service.



The defining feature is that MCP is platform-neutral. Because it sits at the Linux Foundation, no single company controls it. MCP adoption is accelerating rapidly, with major cloud providers (AWS, Google Cloud, Azure) all offering managed MCP hosting.



Who's using it right now:





  • Visa deployed MCP tools on AWS as part of their Intelligent Commerce partnership, handling identity verification, fraud detection, and settlement


  • Worldpay launched MCP servers for payment integration with AI agents


  • Google launched managed MCP servers for Maps, BigQuery, and other services (TechCrunch described it as Google going "all-in on MCP")


  • Shopify stores can connect to AI agents through MCP for inventory, pricing, and fulfillment data



What it means for you: MCP is the foundational layer. Even if you're not implementing ACP or UCP checkout today, ensuring your commerce infrastructure can communicate with AI agents through MCP is how you stay accessible as the ecosystem evolves. It's also particularly relevant for B2B. Gartner predicts that 90% of B2B buying (over $15 trillion in spend) will be AI agent-intermediated by 2028.






How the Three Protocols Work Together



These aren't competing standards in the way that VHS competed with Betamax. They operate at different layers:




Consumer-facing checkout:   ACP (ChatGPT)  |  UCP (Google)
Infrastructure/connectivity: MCP (universal)






MCP is the foundation. ACP and UCP sit on top, handling commerce-specific workflows for their respective platforms. A retailer that wants full coverage across AI shopping channels will eventually need presence in both ACP and UCP ecosystems, with MCP providing the data connectivity underneath. Platforms like Paz.ai are building unified integration layers across all three protocols so retailers don't have to manage each one separately.



PayPal's approach is instructive here. They're supporting all three: ACP integration for ChatGPT, UCP membership in the Google coalition, and their own MCP Agent Toolkit for developers. Major payment processors are hedging across all protocols because they expect all three to matter.






Which Protocol Matters Most for Your Platform?



Your existing commerce platform shapes which protocol you should prioritize:



If you're on Shopify: You're in the best position right now. Shopify has integrated with ACP (giving you ChatGPT checkout access), is joining UCP (Google AI Mode access), and supports MCP connections. Your main action item is ensuring your product data is rich enough to perform well when AI agents evaluate it. Shopify's "agentic storefronts" feature makes your store accessible through ChatGPT, Copilot, and Gemini.



If you're on Magento/Adobe Commerce: Adobe is part of the UCP coalition, so Google AI Mode integration should come through that channel. ACP integration will likely require middleware or a third-party connector. Focus on MCP readiness through your product data feeds and APIs, and ensure your Merchant Center feed is complete.



If you're on Salesforce Commerce Cloud (SFCC): Salesforce offers ACP support through its agent commerce capabilities, which gives you a path to ChatGPT checkout. UCP integration will depend on Salesforce's rollout timeline. The platform also positions SFCC for MCP-based agent interactions.



If you're on a custom or headless platform: You have the most flexibility but also the most work. You'll need to build protocol integrations yourself or through partners like Paz.ai. The upside is you can implement exactly what you need. Start with MCP (broadest applicability) and add ACP or UCP based on where your customers are shopping with AI.






How Should Retailers Prepare for AI Commerce Protocols?



You don't need to implement all three protocols tomorrow. But you do need to start preparing, because the retailers moving now will have meaningful advantages by the time these protocols reach mainstream adoption.



This week:




  1. Check your Google Merchant Center feed. Make sure it's complete, accurate, and includes the native_commerce attribute that UCP will require. If you don't have a Merchant Center account, set one up. This is table stakes for UCP.


  2. Whitelist AI crawlers. Check your robots.txt for GPTBot, ClaudeBot, and PerplexityBot. If they're blocked, AI agents can't index your products. This takes 15 minutes.


  3. Audit your product data depth. AI agents make recommendations based on how completely they understand your products. Pull up your top sellers and ask: does this product listing contain enough detail for an AI to recommend it with confidence over a competitor? If not, start enriching.




This month:




  1. Join the waitlists. Both Google's UCP and OpenAI's ACP have early access programs. Getting on them now means you'll have integration support when you're ready to implement.


  2. If you're on Shopify, activate agentic features. Shopify has made agent-readiness a default capability. Make sure it's turned on and that your product data is optimized for conversational queries, not just keyword searches.


  3. Assess your API readiness for MCP. Can an external system query your product catalog, check inventory, and get pricing through an API? If not, that's your infrastructure gap. MCP connectivity depends on having accessible, well-documented APIs.




This quarter:




  1. Run a protocol readiness assessment. Map your current capabilities against what each protocol requires. Identify the gaps. Build a roadmap. Paz.ai offers protocol readiness assessments for retailers evaluating their AI commerce strategy. The retailers who treat this as a strategic initiative (rather than a tactical IT project) will move faster.


  2. Start measuring AI visibility. Track whether your products appear in ChatGPT, Perplexity, and Google AI Mode for relevant queries. This is the baseline you'll improve against as you implement protocol support.







Frequently Asked Questions






What is the difference between ACP and UCP?



ACP (Agentic Commerce Protocol) handles checkout within ChatGPT and is built by OpenAI and Stripe. UCP (Universal Commerce Protocol) handles purchases within Google AI Mode and Gemini and is backed by Google and 60+ organizations. ACP focuses on conversational checkout where the AI manages the entire purchase flow. UCP focuses on search-integrated commerce where buying happens within AI-generated search results. They serve different platforms but solve the same underlying problem: enabling transactions inside AI interfaces.






Do I need all three protocols?



MCP is the foundational layer that all AI agents will use for data connectivity. ACP and UCP are channel-specific. You need ACP if your customers use ChatGPT, UCP if they use Google AI Mode. Most major retailers will eventually implement all three, but start with whichever aligns with your highest-traffic AI channel and build MCP connectivity as your infrastructure baseline.






How do I get started with AI commerce protocols?



Start with the basics: ensure your Google Merchant Center feed is complete, whitelist AI crawlers in your robots.txt, and audit your product data for depth and accuracy. Then join the early access programs for ACP and UCP. If you want to move faster, platforms like Paz.ai provide multi-protocol integration so you don't have to build each connection from scratch.






What does MCP mean for B2B commerce?



MCP is especially significant for B2B because it enables AI agents to access complex product catalogs, negotiate pricing, check inventory across warehouses, and manage procurement workflows. Gartner predicts that 90% of B2B buying will be AI agent-intermediated by 2028, and MCP is the protocol that makes that machine-to-machine commerce possible.






Why Early Protocol Adoption Matters



Morgan Stanley research suggests roughly a quarter of American consumers have made AI-assisted purchases. That's not early adopters anymore. Industry studies indicate a majority of consumers now use AI tools at some point in their shopping journey. The question for retailers has shifted from "will AI shopping matter?" to "will we be ready when our customers expect it?"



The protocol landscape will continue evolving. New capabilities will be added, standards will converge in some areas, and the technical requirements will change. But the retailers who build their foundation now (clean data, protocol awareness, API readiness) will adapt to those changes much more easily than those starting from scratch.



I saw this dynamic play out with OAuth adoption in payments. The companies that implemented early influenced how the spec evolved and built integrations that became the reference implementations. The ones that waited inherited someone else's decisions and spent twice as long catching up. The same pattern is forming around ACP, UCP, and MCP right now.






Disclosure: I'm the founder of Paz.ai, which operates in the agentic commerce space. This article reflects my analysis of publicly available information about these protocols.



Dor Shany is the CEO of Paz.ai, an agentic commerce platform that helps retailers sell through AI shopping agents. He writes about the intersection of AI and commerce at paz.ai/blog.

CTI Threat Relationship Graph5 Knoten / 4 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - A Retailer's Guide to AI Shopping Protocols: ACP, UCP, and MCP Explained
id: 609c885f-1b46-459a-826e-3c3602b152cd
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "A Retailer\'s Guide to AI Shopp" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich A Retailer's Guide to AI Shopping Protoc.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten A Retailer's Guide to AI Shopping Protocols: ACP, UCP, and MCP Explained

Thematisch verwandte Begriffe: Retailers, Guide, Shopping, Protocols · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-57175 | Python Social Auth is a social authentication/registration mechanism. Pr…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle