In the Sources podcast with Alex Heath, posted on October 21, 2026, Sundar Pichai describes two ways AI agents will reach websites: browsing pages the way a person would, and protocols such as MCP or UCP, which he considers more scalable but slower to develop. On the browsing side, Google documents Google-Agent, a user-triggered fetcher that generally ignores robots.txt, with its user agent strings, IP ranges and a request signature in testing. On the protocol side, UCP lets a merchant open direct buying in Google's AI Mode and in Gemini, or transfer the cart to its own site.
Contents
On October 21, 2026, Sundar Pichai described in the Sources podcast, hosted by Alex Heath, how AI agents will access websites.1 Search Engine Journal reported his remarks on October 22 and recalled that Google already publishes Google-Agent, the fetcher for agents hosted on its infrastructure, as well as a commerce protocol, UCP.2 This article covers those remarks, Google's entry on Google-Agent and what the UCP documentation provides for an online store.
01What Pichai said: two ways to reach websites
Alex Heath asks Sundar Pichai whether the web needs to evolve for agents that use a browser the way a person would, noting that the current setup can feel like trying to fit a triangle into a square.2 Pichai answers with two routes. The same interview also covers Google's agent layer and the place of advertising.
Browsing and protocols
Pichai says both routes will exist and both will grow.2 He describes an agent using a browser as an elegant way to work, since it is what the user would do, and one that allows controls that keep the user in the loop.2
He calls better protocols a far more scalable approach that would work anywhere and instantly, while expecting them to take longer to develop.2 He points to momentum behind MCP, agent protocols and payment protocols, UCP included, expects a chaotic evolution and hopes it moves toward more interoperable standards.2
| Route | Principle | Example on Google's side |
|---|---|---|
| Browsing | the agent goes through the pages of a site and acts at the user's request | Google-Agent, for agents hosted on Google's infrastructure3 |
| Protocols | the agent and the site exchange data through a shared standard | UCP, for purchases in AI Mode and Gemini4 |
Search Engine Journal concludes that agents visiting pages like a person will remain visible while common standards such as UCP are being established.2
An agent layer between Search and Gemini
In the part of the interview reported by Roger Montti, Pichai answers a question about merging Search, AI Overviews and Gemini. He describes an agent layer that provides the unified experience, rather than a convergence of products: those agents run in the cloud around the clock, hold the user's context and pick a task up where it was left.5
He places the near-term vision in "one box" and says the share of agentic queries has been rising steadily in Gemini usage.5 Google plans to make Gemini's agent features, so far offered mainly to Ultra and Pro subscribers, more widely available over the next few months.25
Advertising and the Amazon case
Alex Heath asks how Google protects its own interfaces when agents do the browsing, recalling that its ads business requires engagement and citing Amazon's block of Muse.2 Search Engine Journal explains that Amazon cut off Meta's Muse personal agent from Amazon.com in September, saying the agent does not identify itself when it browses.2
Pichai answers that the right long-term answer is to put users first, that the market will reach an equilibrium and that the equilibrium will shift, comparing the period to the early days of the Internet.2 Search Engine Journal notes that his answer did not address how Google's ads would work when an agent does the browsing.2
02Spotting Google-Agent in your logs
Google lists Google-Agent among its user-triggered fetchers, a list that covers only the requestors most likely to show up in log files and that Google has received questions about.3 The entry gives the user agent strings, the IP addresses and the reverse DNS mask to compare against what the server recorded.
Google's entry
Google describes Google-Agent as used by agents hosted on Google infrastructure to navigate the web and perform actions upon user request.3 There is a mobile variant and a desktop variant, and both user agent strings carry the Google-Agent token.
| Variant | User agent string published by Google |
|---|---|
| Mobile agent | Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/W.X.Y.Z Mobile Safari/537.36 (compatible; Google-Agent; +https://developers.google.com/crawling/docs/crawlers-fetchers/google-agent) |
| Desktop agent | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Google-Agent; +https://developers.google.com/crawling/docs/crawlers-fetchers/google-agent) Chrome/W.X.Y.Z Safari/537.36 |
In these strings, W.X.Y.Z stands for the Chrome version number.3
IP addresses and reverse DNS
Google publishes the IP ranges of its user-triggered fetchers in three JSON files, and Google-Agent uses the ones in user-triggered-agents.json.3 The reverse DNS mask of these fetchers matches ***-***-***-***.gae.googleusercontent.com when the fetcher is Google-owned, or google-proxy-***-***-***-***.google.com when it is user-owned.3
The same page warns that the user agent string can be spoofed.3 An address found in a log can be checked against the published lists: the site's bot IP checker compares an address with Google's lists, including the one for user-triggered agents.
Robots.txt and user-triggered fetchers
Google writes that, because the request comes from a user, these fetchers generally ignore robots.txt rules.3 Search Engine Journal concludes that a robots.txt block will generally not stop these agents from reaching a page.2
Among other publishers, the family of bots that open a page because a user has just asked a question includes ChatGPT-User, Claude-User and Perplexity-User. The AI crawler access test separates them from training bots and search bots.
Web Bot Auth: signed requests in testing
Google is testing Web Bot Auth, an IETF draft specification, with some of its hosted AI agents.6 The protocol lets an agent cryptographically sign its requests, instead of relying only on self-reported headers and IP addresses.6
Google calls its implementation experimental: not all of its user agents use the protocol, and it does not yet sign every request from the agents that do.6 A subset of Google-Agent requests is signed and authenticates as https://agent.bot.goog, with the Signature-Agent header set to g="https://agent.bot.goog".6
Google recommends continuing to rely on IP addresses, reverse DNS and user agent strings alongside Web Bot Auth.6 Google says major CDNs, WAFs and bot-detection services support the protocol and that some let you look up the Google-Agent user agent and add it to an allowlist, following each provider's own steps.6
03UCP: what the protocol offers an online store
UCP, one of the protocols Pichai named, is an open standard for agent commerce that Google built with a group of companies.2 According to Google Merchant's UCP page, a merchant can adopt it to enable agentic actions in AI Mode in Google Search and in Gemini, starting with direct buying.4
What the UCP page promises the merchant
The page makes three arguments: the merchant remains the Merchant of Record and keeps its customer data and relationships, it uses the shopping feeds of its existing Merchant Center account to reach buyers in AI Mode and on the Gemini web app, and the system creates a transparent accountability trail between merchants, credential providers and payment services.4 The Gemini app is listed as coming soon.4
On the technical side, Google describes a modular protocol, compatible with AP2, A2A and MCP, that supports a REST API or an MCP binding and comes with native SDKs.4 For the catalog side, two pages of this site cover what search engines read on a store: Product markup, which passes a product's price, reviews and availability, and online store SEO, which covers product pages.
| Option | What Google says |
|---|---|
| Native checkout | checkout is integrated directly with AI Mode and Gemini; it is the default integration4 |
| Embedded checkout | an optional path reserved for specific, approved merchants, for a highly bespoke brand or a complex checkout flow that requires an iframe-based solution4 |
| Transfer to merchant cart | items move from Google to the merchant's site, which completes the purchase; the option is enabled by supporting the Cart API7 |
The Merchant Center hub and cart transfer
In its September 16 article, Search Engine Journal reports that Google is rolling out cart transfer and expanded checkout testing in the UCP hub of Merchant Center.7 The checklist for the transfer option skips full product feed setup, product warnings and customer support details, and a sandbox in the same tab lets merchants test the cart and checkout requests Google might send.7
The hub is being introduced gradually in the U.S., with Australia and Canada planned for early 2027.7 A merchant completes the technical setup, submits an interest form and waits to be selected.7 According to the Google post the article cites, UCP already enables direct checkout for hundreds of thousands of brands and retailers across Google.7
The documentation also describes a UCP analytics dashboard, available to merchants who have enabled UCP and hold the Performance role: it tracks the journey from the click on the Buy button to the completed order, with average order value and cancellations.7
The industries and features announced
The UCP page announces an expansion to new industries, starting with lodging and food, with a waitlist for each.4 Its roadmap cites multi-item carts, account linking for loyalty programs and post-purchase support for tracking and returns.4
Search Engine Journal adds that the UCP overview page highlights lodging, with booking in AI Mode, and that food features are marked as coming soon.2