September 9, 2026. Gorgias shipped a change yesterday that moves its AI Agent from answering questions over SMS to doing things over SMS. A shopper can now text in, prove who they are, and have an AI cancel the order and issue the refund without a human reading the conversation. If you run support for a Shopify store, the settings you choose this week decide what your AI is allowed to spend.
What Gorgias shipped
- Identity verification over SMS. A shopper who texts in can verify by giving an email address or a phone number in international format, then entering a one time code sent by email or text.
- Actions unlocked once verified. The AI Agent can cancel an order or update a shipping address in the conversation, where SMS previously required a handoff to a human.
- Available to merchants now, with the same capability flagged for social media channels next.
- SMS is a paid add on. Gorgias sells the SMS channel as a separate subscription, so this is not something that switches itself on for every account.
A cancellation is a financial transaction, not a status change
This is the part worth slowing down on. Gorgias documents its cancel order action as a sequence rather than a flag: the AI checks whether the order is unfulfilled, and if it is, cancels it, restocks the items, and processes a refund. Three systems move. Inventory changes, money leaves, and the order record closes.
Editing a shipping address is smaller but sits in a more sensitive place, because a changed delivery address on an unfulfilled order is the oldest trick in retail fraud. Neither action is reckless on its own. Both are simply larger than the word "action" suggests, and both are now reachable from a text message.
The guardrails Gorgias gives you, and the one you owe
To Gorgias's credit, the defaults are conservative and the company says so. Actions are opt in and configurable: you choose which ones the AI Agent may take and the conditions under which it takes them, and the agent asks the customer to confirm before doing anything. None of this arrives switched on.
The decision that remains yours is where the one time code goes. Verification accepts an email address or a phone number, and the code can be sent by email or by text. For a conversation that arrived by SMS, sending the code by SMS to the same handset means the channel is verifying itself. That may be perfectly acceptable for address edits on low value orders and a poor idea for cancellations on high value ones. Nobody at Gorgias can make that call for you, and the product does not make it by default.
What it means for operators
Enable the actions you would already let a junior agent take unsupervised, and no others. That is a sharper test than it sounds, because most support teams do not actually let a new hire refund an order in week one, yet the same team will happily switch on an AI that can.
Then set a floor. If your platform lets you condition an action on order value, fulfilment status or customer history, use it, and put cancellations above the line where a human still looks. Watch the first two weeks of AI executed cancellations the way you would watch a new payment integration, not the way you watch a chatbot.
There is a wider shift here that goes past one vendor. Support automation used to mean deflection: the bot answered, and anything consequential went to a person. Increasingly the bot transacts, and the interesting compliance questions move with it. An AI that sends verification codes and confirms actions over SMS is doing automated messaging to consumers, which is the same territory that makes TCPA compliant AI calling a design problem rather than a feature. Whichever channel it runs on, the rule is the same: decide what the agent may do before you find out what it did.
Frequently Asked Questions
After a shopper verifies their identity, the AI Agent can take actions in the conversation rather than only answering questions. Gorgias names cancelling an order and updating a shipping address. Previously an SMS conversation that needed one of those changes had to be handed to a human agent.
The shopper provides an email address or a phone number in international format, then enters a one time code sent to them by email or text. Only after that does the AI Agent become able to take account changing actions in that conversation.
Not by default. Gorgias makes actions opt in and configurable, so the merchant chooses which actions the agent may take and under what conditions, and the agent asks the customer to confirm before acting. What it does not decide for you is the risk threshold, such as whether a high value order should still route to a human.
According to Gorgias's own documentation the agent checks whether the order is unfulfilled, and if so cancels it, restocks the items and processes a refund. It is worth treating as a financial transaction rather than a status update, because inventory and money both move without a human in the loop.