Transaction and Commerce Agents

Agents that shop, check out and pay on a user's behalf.

Neither Visa nor Mastercard has published a dispute rule written for agent payments, so liability is set by protocol terms and by courts. Alipay's AI Pay passed 120 million transactions in one week in February 2026.

Agent commerce at a glance: Alipay AI Pay in one week, Feb 2026, 120M+ transactions; Supporting Google AP2, 60+ organizations; Google UCP at launch, 25+ partners; Card network agent dispute rules, 0 rules AGENT COMMERCE AT A GLANCE 120M+ TRANSACTIONS Alipay AI Pay in one week, Feb 2026 60+ ORGANIZATIONS Supporting Google AP2 25+ PARTNERS Google UCP at launch 0 RULES Card network agent dispute rules
Alipay AI Pay, one week
120M+
AP2 supporters
60+
Visa VAMP excessive threshold
1.5%
Registry incidents
0

Deployments

China leads agent payments by volume; US firms compete on protocols

Alipay's AI Pay places orders from chat in the Qwen app and Taobao. OpenAI's Agentic Commerce Protocol, built with Stripe, puts chargebacks on the merchant. Google's UCP and AP2 launched with Shopify, Etsy, Target and Walmart and use cryptographic proof of user consent.

Flagship commerce agents deployments
DeploymentDeveloper / operatorWhereScaleAutonomyStatusControls declared
Alipay AI Pay in the Qwen AppAnt Group and Alibaba / ConsumersChina120 million+ transactions in one week (Feb 2026)Places orders from chatGenerally availableConfirmation step; voice plus confirm on glasses
ChatGPT checkout and Agentic Commerce ProtocolOpenAI with Stripe / US merchantsUSNot disclosed (2026)Completes purchases in chatMoved toward merchant-site checkoutTokenized delegated payment; merchant accepts the order
Google UCP and AP2Google / Shopify, Etsy, Wayfair, Target, WalmartUS25+ partners (Jan 2026)Checks out with stored walletGenerally availableCryptographic proof of user consent

Recent events

  • A federal judge barred Perplexity's Comet from password-protected areas of Amazon on March 9, 2026; the Ninth Circuit vacated it.
  • Visa launched its Trusted Agent Protocol with Cloudflare on October 14, 2025.
  • Mastercard's August 2026 research calls agent payment liability an open problem.
  • Mastercard and Google announced the Verifiable Intent specification on March 5, 2026.

Attack surface

Four of ten attack-surface dimensions rate very significant or critical

Behavior boundary rates critical. Ratings use five levels, from limited to critical, and cover the paths an attacker or a failure can take into the agent.

Attack surface by dimension: Physical access limited; Identity and authentication very significant; Command and control channels very significant; Perception and sensors limited; Connectivity surface significant; OTA and update pipeline significant; Data capture and retention significant; Integrations and permissions very significant; Behavioral and policy boundary critical; Multi-agent coordination significant Physical access LIMITED Identity VERY SIGNIFICANT Command and control VERY SIGNIFICANT Perception LIMITED Connectivity SIGNIFICANT OTA updates SIGNIFICANT Data capture SIGNIFICANT Integrations VERY SIGNIFICANT Behavior boundary CRITICAL Multi-agent SIGNIFICANT
Attack surface rating by dimension. Longer, darker bars are rated higher.
Commerce agents attack surface by dimension
DimensionRatingWhy
Physical accessLimitedThe agent is software
Identity and authenticationVery significantUser credentials, agent operator credentials, payment account access, brokerage credentials, banking authority
Command and control channelsVery significantThe prompt is the command
Perception and sensorsLimitedTransaction agents operate on textual and structured inputs
Connectivity surfaceSignificantAPI access to payment processors, trading platforms, merchant systems, banking infrastructure
OTA and update pipelineSignificantModel updates, prompt template changes, policy updates flow through operator infrastructure
Data capture and retentionSignificantTransaction history, customer financial data, behavioral patterns
Integrations and permissionsVery significantThe defining dimension
Behavioral and policy boundaryCriticalTransaction limits, approval thresholds, blocked counterparty lists, fraud detection rules
Multi-agent coordinationSignificantAggregated agent behavior at market scale produces effects no single agent could

Incidents

No registry incident involves commerce agents yet

The 137AI Incident Registry logs an incident when an agent's failure or misuse caused harm or a regulator acted, and public sources name the developer, the failed control and how it was found. No commerce agents case meets that bar yet. Candidates go on the review list in the registry methodology.

Rules

A US appeals court, not a regulator, gave the first answer on agent shopping

Rules that apply to commerce agents
RuleJurisdictionWhat it requiresStatus
Reg E and Reg Z (CFPB)USUnauthorized-transfer and billing-error liability; agent status unresolvedIn force; no agent guidance
Amazon v. Perplexity (Ninth Circuit)USVacated the injunction against Perplexity's Comet shopping agentAug 2026
HM Treasury payment services consultationUKAsks whether consent and liability rules need updating for agentsClosed Oct 6, 2026
EMVCo agentic payments frameworkGlobalIndustry framework for agent paymentsDraft
China agent Implementation OpinionsChinaSector filing and boundaries for agentsEffective Jul 15, 2026

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Agent class
Software
Datasets
ai_deployments.csv (3 rows for this page); ai_attack_surface.csv (10 rows); ai_incidents.csv (0 linked)
Key sources
Alipay AI Pay (Business Wire)
Agentic commerce rules (Chargeflow)
Perplexity ruling
Last verified
October 2026