What AI agents can't do on websites yet
AI agents can already find products, compare them and fill a cart. They still stop at a handful of familiar obstacles. Here's an honest list of what today's agents can't reliably do on websites, which of those obstacles are yours to remove, and which are worth waiting out.
CAPTCHAs and bot challenges
A CAPTCHA exists to stop automated visitors, and an AI agent shopping for someone is an automated visitor. It isn't a skill gap that the next model will close: it's a door built to keep agents out, doing its job. When an agent meets a challenge it typically stops, or hands the page back to the person.
This one is common. In our study of 255 online stores, 6% had a CAPTCHA on the home page. Of the 193 stores whose cart or checkout we could load, 15% showed a CAPTCHA to every visitor there.
- 5% of stores had a CAPTCHA on the home page
- 15% of 193 stores with a loadable cart or checkout showed a CAPTCHA to every visitor there
Yours to fix now. Challenge suspicious traffic, not everyone, and let verified AI assistants through. That's usually a setting in your CDN or bot protection, not a rebuild. See bot protection and CAPTCHAs.
Logins and two-step verification
An agent can't sign up for someone, and it shouldn't hold the person's password. Codes sent by text message or an authenticator app go to the person, not the agent. So a checkout that requires signing in is, for most agents today, a checkout that ends with "please finish this yourself".
Agent makers are cautious here for good reason. Anthropic's computer use documentation warns developers that "using computer use within applications that require login increases the risk of bad outcomes as a result of prompt injection", where text on a page tries to steer the agent. OpenAI's computer use guide tells developers to "treat screen content as untrusted".
Yours to fix now. Offer guest checkout, and keep content people need before buying (prices, sizes, delivery costs) outside the login. See guest checkout and login walls and gated content.
Payment is handed back to the person
This is the limit most likely to stay, and it's a deliberate one. Both major model makers tell developers to keep people in charge of money. OpenAI's guide says to "keep users in control of purchases, data transmission, destructive changes, and other actions that are hard to reverse". Anthropic's recommends asking a human to confirm tasks "such as accepting cookies, completing financial transactions, or agreeing to terms of service".
- Agent finds and compares Product pages, prices, stock, policies
- Agent fills the cart Options, quantity, delivery details
- Person confirms Payment, terms and anything hard to undo
That's not a failure to design around. It's the shape of agent shopping for now: the agent does the research and the cart, and the person approves. Our own Ghost Agents work the same way and stop at the payment step. Agentic commerce protocols aim to let agents pay on someone's behalf with their permission, but they're early. See agentic commerce protocols explained.
Yours to fix now. Make the hand-off smooth: a clear cart summary, total cost before payment, and familiar wallet options for the person to finish with.
Custom widgets and long forms
Browser agents use your page through what they can see and what the page says each control is. Standard controls are easy. Custom ones are not: a size picker that only reacts on hover, a color swatch with no name, a date picker built from plain boxes. Anthropic's documentation says plainly that "some UI elements (such as dropdowns and scrollbars) might be tricky for Claude to manipulate using mouse movements".
Long, multi-step forms add another risk. The same documentation notes that Claude "sometimes assumes outcomes of its actions without explicitly checking their results". On step four of a booking form, an error message that's easy to miss can send an agent onward with a field still empty.
Hard for agents
- Swatches and pickers that are styled boxes
- Fields labeled only by placeholder text
- Errors shown only in red, far from the field
Easy for agents
- Real buttons, radio buttons and selects with names
- A visible label on every field
- Errors in words, next to the field they're about
Yours to fix now. Use native controls or label custom ones properly, and write errors agents can act on. See variant pickers and buttons, links and forms.
Pop-ups and consent banners
A newsletter pop-up or cookie banner covering the page stops an agent's click from landing. In our store study, 38% of stores showed a pop-up or banner that covers much of the page on arrival, and on 24% it had no clearly labeled button to close it.
Consent banners add a twist. An agent might find the "Accept" button, but should it press it? Anthropic's guidance lists accepting cookies among the things to confirm with a person. Expect some agents to pause there.
Yours to fix now. Keep banners from covering the page's main action, and give every pop-up a clearly labeled close button. See cookie banners and pop-ups that trap AI agents.
Fix now, or wait?
Some of these limits are about skill, and those may ease: Anthropic's documentation already notes that "model choice affects click precision". Other limits are chosen on purpose, like handing payment back, and won't vanish soon. So the useful split isn't "what will agents learn", it's "what's in our control":
| Do now | Watch, don't rush |
|---|---|
| Let verified AI assistants past bot protection; drop CAPTCHAs for everyone | Agentic payment and checkout protocols, as your platform adds them |
| Offer guest checkout | WebMCP, an early browser proposal |
| Label fields, name buttons, use native controls | Building your own MCP server, unless you have a clear use |
| Make pop-ups easy to close | Agents that sign in for people with delegated access |
The left column helps every agent today, and people too. The right column is worth a quarterly check-in with your platform. If you're weighing an MCP server, read should you build an MCP server yet? first.