AI Agent Shopping Traffic Triples: What Should Ecommerce Prepare for in the Age of Agentic Commerce?

Summary

As agentic commerce, where AI goes beyond product recommendations to handle discovery, comparison, and even purchasing, continues to expand, the nature of ecommerce traffic is also changing. As seen in Shopify’s case, AI-driven traffic and orders are growing rapidly, meaning AI is no longer simply a search or recommendation channel. It is becoming a new type of client that generates actual purchases and API requests.

The challenge is that a single user intent can expand into multiple automated requests across product, pricing, inventory, ordering, and other systems. As a result, ecommerce businesses need to look beyond visitor counts and understand who is making requests, for what purpose, which APIs they are calling, and how frequently.

Traffic management in the AI era therefore needs to move beyond the traditional distinctions of human vs. bot and Good Bot vs. Bad Bot, toward a more contextual approach.

In the Age of Agentic Commerce, How Should Ecommerce Businesses Classify Traffic?

How much do you use AI when shopping?

We are moving beyond simply asking AI to recommend products and choosing from a shortlist. Agentic commerce, in which AI searches for products, compares options, and even completes purchases on behalf of consumers, is emerging rapidly.

This shift began accelerating in 2025 as Shopify integrated with ChatGPT. According to Shopify’s Q2 2026 results, AI-driven traffic to merchant stores increased threefold year over year, while orders originating from AI search also tripled. New buyers coming through AI channels were also approximately twice as likely to place an order compared with customers acquired through other channels.

Consumers are beginning to move beyond searching for products themselves and toward purchasing based directly on AI-generated decisions.

The shift was even more pronounced in first-quarter data. Sessions referred to Shopify stores through AI chatbot recommendations increased by more than eight times year over year, while orders originating from AI search increased by approximately 13 times. Customers arriving through AI search also showed conversion rates roughly 50% higher than those coming from traditional search, with average order values approximately 14% higher.

Is AI Really Starting to Generate Purchase Traffic?

Until recently, most discussions around AI commerce focused on questions such as:

“Which products will ChatGPT or Gemini recommend?”

or

“What content should we create, and how should we redesign our websites so that AI systems cite or recommend our products?”

However, the customer buying journey is expanding much faster than that.

In the future, ecommerce traffic may increasingly be divided into categories such as the following.

The most important question in internet traffic is no longer simply whether the visitor is a bot or a human.

What is the purpose of the request, and which part of the service is it attempting to access?

This is becoming the more important question.

How Is AI Agent Traffic Different from Human Traffic?

Humans typically search, click through pages, browse products, compare options, and eventually make a purchase.

AI agents may follow a similar process, but the key difference is that parts of that process are performed programmatically.

For example, imagine a user asks an AI:

Find me running shoes under KRW 200,000 that are in stock and can be delivered this week.

To complete this request, the AI may need to check multiple types of information, including product listings, prices, available options, delivery details, and inventory.

As a result, unlike a user simply visiting a website once, a single user intent may be converted into multiple automated requests or concentrated calls to specific APIs.

In an AI agent architecture, a single user request can fan out into multiple server and API calls, while delays in external systems may create additional queues or waiting requests within internal systems.

Ecommerce operators therefore need to monitor more than visitor numbers. Relevant metrics may include:

• Requests per second or minute to specific APIs

• Frequency of repeated requests from the same session or account

• Concentration of requests on product, pricing, or inventory APIs

• Login, payment, and order API request patterns

• Repeated retries after failed requests

• API response times and current processing capacity

• The proportion of legitimate user traffic versus automated traffic

What matters is no longer simply whether 100 users entered the service, but how those 100 user intents are translated into requests inside the system.

How Should AI Traffic Be Managed and Processed?

Traditionally, bot traffic has often been blocked because automated traffic may be associated with malicious activity such as ransomware-related attacks, credential stuffing, or attempts to obtain sensitive system information.

However, as AI becomes mainstream, many industry discussions suggest that the traditional Good Bot / Bad Bot classification is no longer sufficient.

In agentic environments, businesses increasingly need to evaluate the identity and intent of an agent together, applying selective access policies rather than simply allowing or blocking all automated traffic.

Akamai’s 2026 Agentic Security Framework similarly proposes an approach that evaluates the identity, behavior, and intent of humans, bots, and AI agents, and controls access according to their level of trust.

In other words, AI traffic management is not simply about blocking AI.

It is about distinguishing which forms of automation provide value to the business and assigning different levels of access accordingly.

AI Commerce Traffic Should Be Managed Through “Identify → Policy → Control”

In practice, this can be summarized in three stages.

The important point is not to stop at Stage 2.

Even legitimate AI agents can generate more requests than a system is capable of processing at once.

Step 1. Identify Who Is Making the Request

The first step is to distinguish incoming automated traffic.

Even in an AI commerce environment, the starting point is to gain visibility into automated traffic.

Businesses should not automatically allow traffic simply because it comes from AI, nor should they block it simply because it is generated by a bot.

Actual behavior needs to be analyzed first.

Step 2. Apply Different Policies Based on APIs and Behavior

Not every page and API carries the same level of risk.

For example, there is no reason to apply the same access policy to a publicly available product description page and a payment API.

Example AI Agent Access Policies

This table does not represent default settings for a specific product. It is simply an example framework that ecommerce businesses can use when designing access policies.

Actual policies should vary depending on the service’s API architecture and business risk.

Step 3. Allow Even Legitimate Requests Only Within Processing Capacity

The fact that traffic is legitimate does not mean that the system can process an unlimited number of requests.

For example, if a payment server can safely process 500 simultaneous requests, allowing 1,000 requests to enter at the same time can still create risk, even if every one of those requests comes from a legitimate user or trusted AI agent.

This is where queue-based inflow control becomes necessary.

Even within the same ordering system, if general product queries and actual payment requests surge at the same time, businesses may consider assigning different processing priorities based on business importance.

Is There a Way to Classify Ecommerce Traffic and Process It According to System Capacity?

In an AI commerce environment, it is important to separate two questions:

“Who should be allowed in?”
and
“How quickly should they be allowed in?”

1. What Kind of Automated Traffic Is This?

First, traffic can be analyzed using multiple signals such as automation tools, connection environments, request frequency, and behavioral patterns.

Based on this analysis, malicious bots and legitimate or beneficial bots can be classified and managed with different policies.

2. At What Rate Should Allowed Requests Be Processed?

When API requests exceed the processing capacity of the system, those requests do not necessarily need to be rejected immediately.

Instead, they can be placed in a queue and admitted sequentially according to available system capacity.

This approach can be applied at the necessary points across API Gateways, web servers, WAS environments, and other infrastructure layers.

Request inflow can then be controlled according to multiple criteria, including priority and response time.

Ecommerce in the AI Era Is No Longer Built for a Web Used Only by Humans

The increase in AI shopping traffic does not simply mean that a new marketing channel has emerged.

AI is becoming both a search interface that discovers and recommends products and, increasingly, a new type of client that directly interacts with services and participates in transactions.

Akamai research published in July 2026 also found that 47.9% of all AI bot traffic was observed in the commerce industry.

Akamai argues that businesses therefore need greater “agentic readiness,” allowing legitimate AI agents to interact with services while blocking malicious automation.

As a result, ecommerce traffic management is likely to move beyond the simple distinction of:

Human vs. Bot

toward four broader questions:

Who is making the request? → What are they trying to do? → How much access should they receive? → How much traffic can the system process right now?

Blocking every AI agent is not the answer.

What will become increasingly important is identifying different types of traffic, allowing appropriate access, and processing those requests at a rate the system can safely handle.