I gave an agent my shopping list this spring, the way the demos tell you to, and watched it try to buy four things. It got two of them, invented a third from a discontinued listing, and stalled on the fourth behind a login it could not talk its way through. So the question that interests me is not whether an agent can check out for you, because it sort of can. It is what you have to hand over to let it, and whether the store even opens the door. Your permission to an AI is not the store's permission. Your yes is not the platform's yes.
Start with what you hand over, because the pitch skips past it. Agentic browsers, Perplexity's Comet, OpenAI's ChatGPT Atlas, the Gemini-powered auto-browsing in Chrome, can scroll a store, fill the forms, and complete a checkout while you look away. The money behind the rush is real enough: by Adobe's own tally, generative-AI-driven visits to US retail sites were up 4,700 percent year over year in mid-2025 and still up 393 percent in the first quarter of 2026 (Adobe, reported by Forbes and TechCrunch). Separately, in March 2026 Adobe put AI-referred traffic at converting 42 percent better than a typical visit, though that is correlation, not magic: someone who opens an assistant to shop is often already far down the funnel.
The genuinely new part is the plumbing for money. In "Buy it in ChatGPT," OpenAI and Stripe shipped Instant Checkout on an Apache-licensed Agentic Commerce Protocol, so a purchase can close inside the chat (OpenAI; Stripe). The design is careful, I will grant that: the merchant stays the merchant of record, the party legally on the hook for the sale, and Stripe's shared payment tokens mean the store never sees your card number. But underneath the vocabulary you are still granting a standing authority to spend. When Walmart tested it, the flow converted about three times worse than sending people to its own site, and Walmart's Daniel Danker called the experience "unsatisfying," at least as Payments Dive reported it. OpenAI has since shifted toward letting merchants run their own checkout while ChatGPT sticks to product discovery.
Now the door itself. On March 9, 2026, a federal judge, Maxine Chesney, granted Amazon a preliminary injunction blocking Comet from logging into Amazon accounts. Her finding is the sentence to sit with: "Amazon has provided strong evidence that Perplexity, through its Comet browser, accesses with the Amazon user's permission but without authorization by Amazon, the user's password-protected account" (order granting preliminary injunction, Amazon.com Services v. Perplexity AI, Doc. 81). That is a preliminary call on Amazon's showing, not a settled verdict, which is why she framed it as Amazon being likely to win under the Computer Fraud and Abuse Act. Amazon says Comet disguised itself as ordinary Chrome traffic and routed around a technical block within a day of it going up; Perplexity says Amazon is guarding ad revenue, not security, and is appealing to the Ninth Circuit, where the three-judge panel, including a district judge, John Hinderaker, sitting by designation, wrestled openly with whether a 1986 hacking law was built for any of this (PYMNTS; CNBC). If it holds, agent access becomes a permission the store grants, not a right you hold, and Amazon has already blocked dozens of agents while pushing Rufus, its own shopping assistant.
And even with the door open, the agent is not reliable the way a tool should be. In the study Fortune covered, the best models cleared 85 percent overall, but Claude Opus 4.5, the most consistent of the lot, still returned a different result on the same task under the same conditions better than a quarter of the time (Narayanan and Kapoor, via Fortune). On tau-bench's airline set, the nearest public stand-in for "book my flight," the leaders sit around 70 percent (Princeton HAL), and a do-nothing agent that books nothing at all scores 38 percent (Kang), so treat even the failure numbers as soft. A booking is not a chat reply. A wrong flight has a date, a fare rule, and a passport on it.
So here is the small thing to do before you let anything shop for you: list what it needs to hold. A logged-in session, a live payment method, and for travel your identity documents. Then let it run only on stores that publish an agent policy you can read, keep it to single, cheap, reversible purchases, and check the receipt every time. That is not fire and forget. It is a power tool with no guard, and you keep your hand where you can see it.
