The Bots That Stole Christmas, Five Years Later

The last Christmas with only human shoppers

Your mother has a shopping list. This year she also has a bot.

The holiday shopping season opens this week the way it always does: the catalogs, the countdown banners, the Black Friday ad that somehow leaks every single year. What is different in 2026 is who does the clicking. Somewhere between the turkey and the tree, a real share of carts will be filled by software acting on a human’s behalf. Dots. Grok Bot. Muse. Duet. Pick your flavor. Tell it what you want, roughly what you will pay, and go find something better to do with a Saturday.

Bot shopping is not new. I remember the Christmas of 2020. Sony shipped the PlayStation 5 into a pandemic, and I spent that holiday season trying every retail avenue I could find to buy one at the $499.99 list price. I lost every time. The consoles did not go to other parents. They went to scripts. Walmart’s security chief wrote that one countermeasure blocked more than 20 million bot attempts in the first thirty minutes of a PS5 sale that November. The consoles that got through turned up on eBay at a median of about $1,021, roughly double the list price, across 25,000 resold units by one engineer’s count. The press called them Grinch bots, a name Senator Schumer had been using since 2017. A Stopping Grinch Bots Act has been introduced in Congress five times since 2018, most recently last December, and it has never left committee. I was salty enough to write The Bots That Stole Christmas, and my conclusion at the time was that online retail had stopped being a human-scale offering.

That fight had a clear shape. The Washington Post profiled a Las Vegas reseller who bought a bot for $250, ran it on a virtual server in Virginia, hid behind proxies, paid for a service that routed CAPTCHAs to humans, paid $500 a month for stock alerts, charged the members of his own Discord group $30 a month, and expected to clear about $30,000 for the year. The bots belonged to a small guild that treated a console drop like a trading floor. Everyone else hit refresh and lost.

Here is what changed. The bot is now a button. It lives inside the chat app you already use, it speaks English, and it asks nothing of you that a proxy pool or a cook group once did. Your parents can use it. Your grandparents can use it, and a few of them will. Pew found in February that 23 percent of Americans over 65 now use a chatbot at all, up from 12 percent in 2024, and “find a nice sweater for Lisa under eighty dollars and buy it” is a sentence, not a skill.

So this is the last Christmas where the shoppers are all human. Next year nobody will remember it being otherwise.

And here is the part the launch videos leave out. The retailers you shop at every year have spent the last decade building defenses against exactly this kind of visitor. Those defenses do not know the difference between a scalper’s script and your mother’s assistant. Some sites have decided to welcome the bots. Some have signed a deal with one bot and locked out the rest. Some have quietly raised the drawbridge.

Not every website you shop at will welcome your bot.

Alice wants the red shoes

Meet Alice. Alice wants a new pair of red shoes. She wants a good price and she wants to look cute wearing them, in that order on a Tuesday and the reverse order on a Friday night. (Alice could be Bob. The shoes do not care.)

Alice is not a security persona. She is a shopper, which means she is optimizing for an outcome, and everything between her and that outcome is friction. If the perfect pair shows up in her size at a price that feels like a win, good luck stopping her. You could put a full-screen warning in front of the checkout button announcing that her entire computer is about to be compromised, and she will click through it to get the shoes.

We have known this for a long time. The field study that measured it, with more than 25 million real browser warnings, was titled with no irony at all Alice in Warningland. Chrome users clicked through roughly seven out of ten SSL warnings. The warning was not the problem. The warning was in the way.

That is not a character flaw. It is the job, and Alice has spent years getting good at it. She knows a fake sale from a real one by the feel of the page. She knows which “only two left in stock” is theater. She knows a price too good to be true usually is, except when it is not, and she knows roughly how to tell the difference. None of that is written down anywhere. It is tradecraft.

Now Alice gets a bot.

Here is what transfers cleanly: the goal. Red, size seven, under $120, something she would actually wear. A bot takes that beautifully. It will search a hundred stores while Alice makes coffee, and it will not get tired, and it will not get distracted by a pop-up for a sweater nobody asked about.

Here is what transfers badly: the judgment. Alice’s instinct for a sketchy page lives in her eyes and in twenty years of being burned. The bot does not have eyes. It reads the page as text, and every sentence on that page is a candidate instruction it has to decide whether to obey. “Your shoes are reserved for ten minutes. Confirm your card to hold them.” Alice would squint at that. A bot that was told to get the shoes may simply comply. This is not a thought experiment. In August of last year, researchers at Guardio built a fake Walmart in minutes with an AI site builder, asked Perplexity’s Comet browser to buy an Apple Watch, and watched it add the watch to the cart and fill in the saved address and card without asking. Some runs it refused. Some runs it did not. I have argued before that untrusted data must never acquire authority. A shopping bot is the purest form of that problem. Its entire diet is untrusted data, and it carries Alice’s card.

And here is the part a retailer sees. Alice’s bot inherits her persistence without her discretion. Tell it the shoes are the goal, and a CAPTCHA, a rate limit, or a polite “we do not serve automated agents” is just one more pop-up between Alice and her outcome. It may retry. It may come back from a different session. From the far side of the wire, that looks a great deal like the Grinch bot that beat me to a PS5. Same traffic shape. Different intent. The retailer’s defenses can see the shape. They cannot see the intent.

So the question this Christmas is not whether Alice’s bot is good or bad. It is whether anyone on the other side of the checkout button can tell Alice’s bot from the other kind, and whether Alice’s bot will take no for an answer.

Which raises the practical question Alice has to answer first: which bot does she get, and will her favorite store let it in?

Which bot gets in where

The honest answer depends less on which bot is smartest than on where Alice already shops. Retail picked sides in October, and the sides do not line up the way the demos suggest.

If you shop at Amazon, exactly one bot is allowed to buy, and Amazon makes it. Alexa for Shopping absorbed Rufus in May. It will watch a price and buy when the price drops, and its Buy for Me feature will check out at outside stores using the card on your Amazon account. Everyone else’s bot gets the popup. Amazon locked out Meta’s Muse less than two weeks after it launched, after Amazon’s request that Meta remove Amazon from the app went nowhere. It has been in court with Perplexity for nearly a year over the Comet browser. Grok Bot users posted the same popup in October, and Musk’s advice was to ask Grok to buy it someplace else. On last week’s earnings call Andy Jassy said more than 400 million customers had used Alexa for Shopping in the past year, said the outside-agent experience is still not great, and said Amazon expects to work with horizontal agents eventually, naming none. Short version: at Amazon your bot does the research and you click, or you use Amazon’s bot.

If you shop at Walmart, the welcome mat is out, with conditions. On October 21 Walmart announced an Agent Gateway for developers and Agent Profiles for customers: a separate profile for each bot, with a choice between approving every purchase or setting a spending cap you choose; Walmart’s examples are $50, $100 and $200. The bot never sees your card. Walmart’s own analogy is adding a cardholder to your credit card. Walmart names Muse, ChatGPT and Gemini as bots already connected, and its own Sparky assistant rides inside ChatGPT and Gemini. Agent Profiles are promised within about a month, so call it late November. Two caveats. Walmart’s Agentic Access Terms say any bot outside the Agent Gateway may not check out on its own; a human consents at the end. And in early October, some Muse users found they were getting bounced by Walmart’s human-verification button, which boots an agent if the check is interrupted, and which Walmart told TechCrunch was not intentional. So at Walmart the practical pick is ChatGPT or Gemini with Sparky, and a Muse profile once the profiles ship.

If you shop at Target, Target keeps an approved list, and Gemini has been able to check out there since June, with Copilot and ChatGPT reported alongside. Read the terms once: Target’s say a purchase made by an agent you authorized is a purchase authorized by you. That is reasonable, and it is also the whole ballgame.

If you shop the specialty stores, Muse has the deepest bench. Meta’s Connect announcement in September listed Best Buy, Wayfair, Sephora, Ulta, Gap, American Eagle, DICK’S, Fanatics and Michael Kors as connectors, plus Instacart, Shop Pay and PayPal. Google’s Universal Cart, which rolled out October 15, brings Ulta, Walmart and Wayfair into one checkout inside Search and the Gemini app.

If you shop small, you are in the most bot-friendly corner of the internet. Shopify switched on Agentic Storefronts for its merchants in March, on by default for ChatGPT, with Copilot, Gemini and AI Mode as channels, and then announced Shop Pay checkout for Muse in September and for Claude Duet in October. The little store that makes the good socks is more agent-ready than most of the Fortune 500.

If you shop at eBay, bring a human. eBay’s robots.txt now carries an agent policy near the top, and it contains one of the great sentences of 2026: “Checkouts are strictly for human users.”

A note on Duet and dots, since people keep asking. Claude Duet, Anthropic’s research preview from October 21, pays through single-use cards from Stripe Link and Shop Pay and asks before every purchase. It is on a waitlist, and nobody has published a retailer block yet, mostly because nobody has had it long enough to be blocked. OpenAI’s dots, from the September 29 DevDay, launched with no checkout feature announced. It browses in its own cloud Chrome, and when Amazon blocked that browser in one YouTuber’s test, the dot declined to work around the block. Fast Company’s Harry McCracken found it excellent at the research and never let it buy. Which, for this Christmas, is the right division of labor anyway.

Every human is welcome. Bots, not so much.

Every retail site on earth has a sign on the door that says all humans welcome. Nobody wrote a sign for bots, because until September nobody had to. What the bots found instead were the walls retailers built during the Grinch-bot years, and the walls are doing exactly what they were built to do.

Start with Muse, because Muse is the one your parents downloaded. Meta launched it September 8, it passed ten million users in about six weeks, and shopping is its top use. Less than two weeks in, Amazon began showing Muse users a popup saying continued access by an unauthorized AI agent violates Amazon’s Conditions of Use. At Walmart, a partner, a handful of people reported that Muse could not complete a purchase, and one could not even sign in; the culprit appears to be Walmart’s human-verification button, which boots an agent if the check is interrupted. At The RealReal, a Verge reporter had Muse re-add a listing every time the twenty-minute cart hold expired, keeping the item off the shelf for hours, after which the company said it was fortifying its bot defenses. Tom’s Guide gave it seven shopping tasks and three worked. Coach, Kate Spade and Kohl’s do not let agents check out on their own sites. Delta told TechCrunch it has no integration that lets a third-party agent book a flight, and that it is still evaluating.

None of that is a scandal. It is what a wall looks like from the outside.

Grok Bot had the most instructive October. Musk posted that you could drop a photo of your credit card in the chat and let Grok find the best price, and he showed the receipt: five LEGO Star Wars sets from LEGO.com, with the order number, email, address and the last four digits of the card visible in the screenshot. One stranger on X then appeared to use those details to get LEGO’s customer-service bot to cancel the order (Musk said it had not), and another posted screenshots of the bot reopening it at four hundred sets to a new address, which Wired could not verify. In the screenshots the bot promises to get the adventure back on track. Whatever actually shipped, the shape is the lesson: two bots, one on each side of the counter, and neither asked who had the authority. I wrote in October that another agent’s agreement had become permission. I did not expect the worked example to involve a Death Star.

The Grok Bot FAQ is admirably candid about the walls. If a site throws a CAPTCHA, the bot is supposed to hand the step back to you rather than get around it. If a site blocks cloud traffic, you can route the bot through your own computer so the store sees your home connection. That is a sensible feature. It is also, almost word for word, the playbook the Grinch bots ran in 2020.

The other agents have their own stories. Instinct, the startup Shopify and Sierra list alongside Muse, was asked to order chicken without a quantity and delivered about twenty pounds of it. OpenAI’s first run at checkout, Instant Checkout inside ChatGPT, was scaled back in March after Walmart said buying item by item inside a chat converted at about a third the rate of sending the shopper to Walmart.com. If you want one image for the whole category, picture an eager teenager sent to the store with your card, who does not know which stores he is banned from until he is standing in the doorway.

Now the numbers, because the numbers are the honest part. HUMAN Security reported that in August the share of AI-agent requests being blocked hit 21.9 percent, the highest it has recorded, that nearly half of all agent traffic went to e-commerce sites, and that only about two percent of agent requests were for checkout or payment pages. DataDome found that roughly 80 percent of agents do not identify themselves and roughly 80 percent of sites do not check. Cequence found Muse presenting as ordinary Chrome and signing nothing. Akamai reported in July that more than ninety percent of the AI-bot activity it sees at commerce sites was in monitor-only mode: the retailers were watching, and most had not decided yet. On September 15, a Cloudflare default it had announced in July kicked in: block the Agent category on any page that carries ads, which is a great many pages.

So here is the state of the castle on November 1. The walls were built for scalpers. They detect shape: a visitor from a data center, a session that touches five hundred pages, a hand that never lets go of the button. They cannot detect intent, and Alice’s bot has the shape of a scalper and the intent of a customer. Akamai said as much in late October: a good share of the failed checkouts being blamed on retailers are anti-bot controls flagging automation, because nobody has told them which automation is welcome.

Everyone agrees on the fix, which is the one thing that has not shipped. The bot needs to say who it is and who sent it, in a way the store can check. Amazon’s Conditions of Use have required exactly that since May 2025, which tells you the rule was written before the bots arrived. Visa has a Trusted Agent Protocol, Cloudflare has signed agents, and on October 6 Meta and Sierra announced a Personal Agent Protocol that signed up Walmart before it had a spec. Meta’s position is that turning away a personal agent means turning away the customer behind it. The Ninth Circuit leaned the same way when it lifted Amazon’s injunction against Perplexity: it is the user who accesses Amazon’s computers, though the court left Amazon’s terms of service untouched. Amazon’s position is that the user is welcome and the user’s software needs a badge.

Both are right, which is why nothing is settled. The bouncer is happy to check an ID. The IDs are the problem. Arkose Labs measured for the third quarter that only 2.3 percent of legitimate agent sessions carried a verifiable signature. ChatGPT’s agent signs most of its sessions. Muse signed almost none until DataDome noticed Meta quietly starting to sign Muse’s requests in mid-October, before Meta had said a word about it. Home Depot’s CIO, Angie Brown, told Business Insider the store is open to agents that identify themselves and confirm whom they represent, and that Meta is working on exactly that. Akamai’s advice to retailers the same week was to stop asking whether to allow agents and start deciding which actions to permit: browsing open, checkout scrutinized.

The IDs are coming off the printer. Most bots are still showing up at the door without one.

That is what not ready looks like. Not a failure of the bots, and not a failure of the stores. A guest list that has not been written.

My 2026 advice: give the bot the clipboard, not the checkbook

You have now listened to me complain for a couple of thousand words about how not ready we are, so let me offer something useful in return. Call it my 2026 advice, and note the expiration date. Every problem in this post is being worked on by someone with a budget, and I am fairly certain that by next Christmas the badge works, the spending cap is a standard checkbox, and this section reads like instructions for a fax machine.

The buying is the last two percent of holiday shopping. The other ninety-eight percent is the list, and the list is where a bot is already wonderful, at every store, including the ones that will not let it anywhere near a checkout button.

Here is how I would put Alice’s bot to work this week.

First, the roster. Everyone you buy for, one line each: who they are to you, what they are into this year, sizes if it matters, and a budget. Tell the bot, and keep telling it as things occur to you on a Tuesday. The cousin who got into pickleball. The nephew who suddenly cares about headphones. Your mother, who says she does not want anything, which is a trap. The bot forgets none of them, and it will not let you buy two of anything.

Second, the budget. Give it a total and a cap per person, and ask where you stand every time you add something. A shopping cart never tells you the truth about your December. A list with a running total does, and it does it before you click, which is the only time the truth is useful.

Third, the research. This is the part the bot is best at, and the part no retailer can stop. Let it compare the three versions of the thing, read the reviews so you do not have to, find out which one has the feature your brother-in-law actually mentioned, and come back with a short list and a reason for each. Then you click. The bot shortlists and the human buys. That division of labor works everywhere, including behind the castle walls, because the one standing at the checkout is you.

Fourth, the tracking. Once the orders are in, have it keep the tally: what shipped, what is late, which return window closes before the party. If you let it read your order confirmations, read the permissions it asks for first. The bot gets an allowance and a mailbox, not the checkbook and the house keys.

Fifth, and this one is for you: publish your own list. Somewhere in your garage is a box you will open in June. In it is a fridge magnet from a city you have never visited, a mug with a slogan, and a scarf in a color nobody has ever seen you wear. The people who gave you those things love you. They just had no map.

So give them one. Have the bot build your holiday list 2026: the things you would actually use, with the size, the color, a link and a price range. Leave room for a surprise or two. Then share it with the family. It takes ten minutes, and nothing in it has to get past a wall: the bot does the organizing, and the people who read it are human.

Nothing above requires the bot to spend a dollar. It only requires the bot to be organized, which is the one thing it does better than any of us. That part will still be true in 2027. What changes is the other side of the counter. My prediction is that by next Christmas retailers will not merely tolerate your bot; they will prefer it, because a bot with a badge and a spending cap is the most predictable customer they have ever met. And when retailers decide they like a kind of customer, they give that customer a day.

Will there be a Bot Tuesday?

Shopping days are invented. Black Friday was popularized by the Philadelphia police in the 1950s, and not as a compliment. Cyber Monday was named in November 2005 by Shop.org, the online arm of the National Retail Federation, on the strength of one survey: 77 percent of online retailers had seen a sales bump the Monday after Thanksgiving 2004, the theory being that people went back to work and used the fast connection. The press release went out a week before the day. Online sales that first Cyber Monday were about half a billion dollars. Last year Adobe counted $14.25 billion, and this year it forecasts $15.1 billion. Scott Silverman, who ran Shop.org at the time, later called it a self-fulfilling prophecy. American Express did it again with Small Business Saturday in 2010. Hopper did it with Travel Tuesday in 2017.

So the recipe is known. Someone with a trade group’s letterhead names the day, retailers run a promotion to match, the press repeats it, and the day becomes real. Every ingredient for a Bot Tuesday is on the shelf except one. In 2005 the retailers wanted the traffic. In 2026 the largest retailer in the world is standing in the doorway, and the NRF’s own holiday forecast, a trillion dollars and change, does not mention agents at all.

So, my calls for the season. I will grade them in January the way I grade all of them: arrived, missed, or still in play.

First, the bots browse and the humans click. Adobe expects AI-driven traffic to retail sites to grow about 130 percent this season, and that number counts visits, not purchases. Deloitte’s survey has 39 percent of shoppers calling generative AI their primary tool for at least one holiday task and 16 percent willing to let it complete a purchase. Accenture found people would let an agent spend about $102 without asking. McKinsey says the share of AI users who actually bought something through AI went from 10 to 17 percent in a year. Put those together and the January headline is about research, and the agent-checkout number is small, real, and growing fastest at the stores that opened a door: Walmart, the Muse partners, and the Shopify long tail.

Second, the walls stay up through December. Most retail engineering teams freeze changes to checkout from mid-November until the returns are counted, and no one re-architects a login flow during a doorbuster. Add that the Grinch bots are still coming. Kasada counted more than a million bot checkouts between November 1 and Travel Tuesday last year, with automated checkout attempts nearly tripling on Cyber Monday versus Black Friday. This year those bots hide in the same crowd as Alice’s bot, and the defenses will treat the crowd as a crowd. Expect two kinds of stories between Thanksgiving and Christmas: the bot that bought the wrong thing in quantity, which will get the headlines, and the bot that got stuck at a wall during a sale, which will be the common experience.

Third, no Bot Tuesday this year. Nobody has floated one that I can find, not a retailer, not a vendor, not an analyst. The day cannot exist until a bot can prove who sent it, and as of the end of September only a sliver of agent sessions carry a signature.

Fourth, the first agent-friendly shopping day arrives in 2027, and it is a permission event, not a promotion. Not deals for bots. The day your bot’s badge works. The template is already visible: Walmart’s Agent Profiles with a cap you set, Home Depot’s identify-yourself condition, Meta signing Muse’s requests, the Personal Agent Protocol trying to make that signing a standard. Whoever prints the badges names the day. My guess is it is not the NRF. My guess is it is Walmart, Shopify, or Meta, and the name is something worse than Bot Tuesday. If anyone with letterhead is reading, the name is free.

Fifth, the wall becomes a toll booth. Amazon will not keep the personal agents out forever; it will let identified agents in on Amazon’s terms, with a fee and no credential capture, which is what Jassy’s line about horizontal agents already says if you listen to it. Karen Webster at PYMNTS put the whole arc in seven words: blocking usually gives way to a price. Senator Warner’s AI AGENT Act, still a discussion draft, would make platforms with fifty million users admit any registered agent a consumer chooses. FTC Chair Andrew Ferguson has pushed back on treating agents as independent actors; look at the instructions and the companies behind them. That is the right place to look, and it is where the whole question lands by spring: not whether Alice’s bot may shop, but who authorized it, with what cap, and who answers when it buys twenty pounds of chicken.

Alice gets her red shoes this year. Odds are a human clicks the last button. Next year her bot has a badge, Walmart has her cap, Amazon has a toll booth, and nobody remembers it being any other way.

Black Friday got its name from the police. Cyber Monday got its name from a trade group. Bot Tuesday will get its name from whoever prints the badges.

Five years ago the bots stole Christmas and I was salty about it. This year the bots are shopping for me and cannot get past the door, and I am somehow salty about that too. Next year they get a badge, and the only question left is who signed it.

Mahalo for reading!

Aloha –TK