Five changes for Shopify merchants this week
Five sourced changes from the last two weeks: app security, Shop Pay inside AI agents, catalog Rollouts, Threads ad placements and Managed Markets shipping.
Five changes from the last two weeks. Each section says what shifted, what a merchant can do, and links the source.
Attacks through apps are rising
On October 20, Shopify told app developers that attacks across the app ecosystem are increasing, and that better AI tools are making weak spots easier to find. The forum post asks every developer to scan their app, move to expiring access tokens, and turn on two-step authentication for every account that can touch the app. It does not name a store or an app.
The scan is the developer's job. What you control is the list of apps on the store, and what those apps are allowed to change. An app you stopped using still has the access you gave it on install.
Open Settings, then Apps, and remove anything you do not recognize or no longer use. In the theme, check app embeds and the checkout button, and confirm it still sends people to your own domain. If a customer mentions an extra payment page, that is worth a look the same day.
The full read is the story on what to check after apps sent shoppers to fake checkouts.
Shop Pay can check out inside an AI agent
On October 13 Shopify launched Shop MCP. One connection lets an AI agent search Shopify Catalog, build a cart at the store that sells the product, and complete a Shop Pay checkout. The changelog says the shopper confirms the total and the payment method before the agent finishes, and the order appears in your Shopify admin like any other order. Webhooks were not part of the launch, so the agent has to ask for checkout status itself.
You do not install this. The agent reads the product data you already publish. A thin title, a missing variant, or a policy that disagrees with the product page is what it will get wrong.
The limits, including Claude and Gemini, are in the Shop Pay story. Before the holidays, read your titles and stock the way an agent would, and look at Sales channels, then Agentic, so you know whether those orders can reach you.
Rollouts can schedule catalog changes
On October 23, Rollouts started covering catalogs. You can schedule product availability and pricing for each market, and switch among catalogs you already have, at a date and time you choose. Shopify's changelog says you can also test one catalog against another on the online store, and send the catalog live in the same rollout as a theme or checkout change.
Black Friday is November 27. The useful part is a catalog that turns on when you said it would, next to the theme, and can end with it. Discounts and the end date are covered in the BFCM checklist. If you do one thing this week, open Markets, then Rollouts, and see whether a catalog is attached to the sale.
Threads is selected in Meta ad placements
Meta's help center says the Threads feed is included by default. With Advantage+ placements, you are opted in. If you edit placements by hand, Threads stays selected until you clear it. The help page also says Threads feed cannot run alone: it has to sit next to the Instagram feed. Clicks and post engagement for that placement are still marked in development, so those numbers are directional.
If you have no Threads profile, Meta may run the ad from your Instagram profile or your Facebook Page instead.
Open the ad set, then Placements, and look for Threads. Leave it on if that inventory is something you meant to buy. Clear it if it is not. Wait to judge the placement by its click count until Meta says those metrics are finished.
Managed Markets can lock some label costs
On October 24, Managed Markets added guaranteed flat-rate shipping. It sets Standard and Express rates for each destination, puts part of the shipping cost into the product price, and charges the rest at checkout. Buy a qualifying prepaid FedEx or DHL Express label through Managed Markets and Shopify says you are not billed for a later carrier adjustment. The changelog says you can preview international prices, checkout totals, and expected payouts before you turn it on.
Duty-inclusive pricing is required, and you cannot edit the rates yourself. You can turn the feature off for a single market and go back to your own rates, without the guarantee.
If you sell across borders, open Markets, choose a market, and find Managed Markets. Read the preview against the prices you already promised for the sale. If the payout or the checkout total is wrong, leave it off.
Sources: Shopify developer forum; Shop MCP changelog; Rollouts changelog; Meta help on Threads placements; Managed Markets shipping changelog.