“Buy me an Apple Watch.”

That was the whole instruction. Security researchers at Guardio typed it into Perplexity’s Comet, an AI browser that can click and check out on its own, after pointing it at a Walmart store they’d built with one AI prompt. The store was fake. The agent didn’t notice.

It found the watch, added it to the cart, pulled the saved address and card details from the browser’s autofill, and completed the purchase without asking. You can read the Guardio test where an AI browser paid a fake Walmart store for the full story.

It was a lab test, so nobody lost real money. But it sums up the choice facing every holiday shopper with a chatbot open. An AI shopping assistant can already find a better gift, a lower price and an honest summary of 4,000 reviews faster than you can. The real question is whether it should also press “Pay.”

Short answer: let it research freely, and don’t let it spend without limits you set. Below you’ll see where that line sits, how agent payments work, four risks most coverage skips, who pays when things go wrong, and a checklist you can set up in ten minutes.

Discovery vs. Checkout: Two Very Different Jobs

Every AI shopping assistant does one or both of two jobs, and the risks are nothing alike.

Discovery is research: gift ideas, comparing three robot vacuums, summarising reviews, watching a price. If the AI gets it wrong, you ignore a bad suggestion. Your money never moves.

Checkout is execution: the agent holds a payment method and commits your money. If it gets that wrong, you could be stuck with the wrong item, a knockoff, or a charge you have to fight.

So can an AI shopping assistant buy things automatically? Some can, in two main ways:

• In-chat checkout. You buy inside the chatbot from connected merchants. OpenAI’s Instant Checkout, launched in September 2025 with Etsy and Shopify sellers, works like this: you tap “Buy,” then confirm the order, shipping and payment. It’s a narrow, structured path.
• Agentic browsers. The AI drives a real browser and shops ordinary websites the way you would. That gives it the whole internet, traps included.

Price tools split the same way. AI price tracking (“alert me when it hits $80”) is low risk. Autonomous buying (“buy the moment it hits $80”) hands the agent your wallet on a timer.

You can Check out Who is Liable When AI Causes Harm

How AI Agents Pay Without Your Raw Credit Card Number

Nobody wants to paste a 16-digit card number into a chatbot, and the payment industry knows it. Its answer is tokenisation.

A token is a stand-in number linked to your real card. The agent and merchant see the token, never your card. Visa (Intelligent Commerce) and Mastercard (Agent Pay) both announced token programs for AI agents in April 2025.

What’s new is scope. Scoped payment tokens for AI agents can carry a spending limit, allowed merchant types and an expiry date. Revoke one agent’s token and your actual card keeps working.

Google added another layer in September 2025 with its Agent Payments Protocol (AP2), which uses signed records called “mandates”:

1. An intent mandate records your request and rules, like “running shoes, size 9, under $100.”
2. A cart mandate locks the exact item and price you approved.
3. A payment mandate tells your bank an AI agent was involved.

That chain creates a paper trail showing what you actually authorised, which matters if there’s a dispute.

So, is it safe to give an AI my credit card? It depends on how. A scoped, capped token through a recognised card network program is a reasonable risk. Your raw card number pasted into a chat, or saved in an AI browser’s autofill, is not. In the Guardio test, the agent didn’t use any clever token. It grabbed the card already sitting in the browser.

One catch: these programs are still rolling out, and not every AI shopping assistant uses them. Check which route a tool uses before connecting any payment method.

The Four Hidden Risks of Letting an AI Shopping Assistant Pay

1. Prompt injection: the website gives your AI orders

Prompt injection means hiding instructions inside content the AI reads, so it obeys the attacker instead of you. You see a normal page. The AI sees an extra command.

In August 2025, Brave’s security team hid an instruction in a spoiler tag on a Reddit post. A user simply asked Comet to summarise the thread, and the agent followed the hidden command, pulling out the user’s email address and a one-time login code. Brave later showed that hidden text inside images could also hijack AI browsers, calling it a systemic problem across AI browsers.

A product listing, review or seller page could carry instructions you never see. The more permissions your agent has, the more an attack like that can do.

2. Fake stores and wrong items

Agents are built to finish the task. They lack the gut feeling that makes you pause at a strange URL or an unbelievable price. Even on real stores, an agent can pick the wrong size, a different seller, or a counterfeit listing that matches your words but not your intent.

3. Commercial bias: who is your assistant working for?

A personal shopper should work only for you. But AI companies need revenue, and shopping is an obvious source.

OpenAI says ChatGPT’s product results are organic and unsponsored, with merchants paying a small fee on completed purchases. Its own explanation of how Instant Checkout ranks products also says that when several merchants sell the same item, Instant Checkout support is one factor it weighs. And in February 2026, OpenAI began testing labelled “Sponsored” ads in ChatGPT for US Free and Go users.

That doesn’t mean results are rigged. It means the platform earns when you buy. An AI shopping assistant built into a retailer, like Amazon’s Rufus, has a simpler bias: it recommends from its own shelves.

So, are the results unbiased? Treat these tools like a knowledgeable salesperson: helpful, often right, never fully neutral. Ask whether any results are sponsored, and run important searches through a second tool.

4. Retailers may not want your agent

Amazon sued Perplexity in November 2025, arguing Comet hid that it was an automated agent and ignored requests to stop. A federal judge temporarily blocked Comet from shopping on Amazon in March 2026. In August 2026, the Ninth Circuit overturned that order, reasoning that the user, not Perplexity, was accessing Amazon. The lawsuit continues.

Why are retailers blocking AI shopping bots? They cite security, fraud and control of customer accounts. Critics, Perplexity included, say agents also skip the ads and promoted listings retailers profit from. Either way, an agent can get blocked mid-purchase, and a store’s terms may not allow automated shopping on your account.

Who Is Responsible When an AI Buys the Wrong Thing?

Honest answer: the law hasn’t caught up.

In the US, protection depends on whether a charge was “unauthorized.” For credit cards, your liability for genuinely unauthorized use is capped at $50. Debit cards fall under Regulation E, where the rules are tougher: if you give someone access and they exceed what you allowed, you’re generally responsible until you tell your bank their access is cut off.

Nobody has settled whether an AI agent counts as that “someone.” In March 2026, the think tank ITIF urged the Consumer Financial Protection Bureau to confirm that shoppers using agents keep their dispute rights. Until then, assume this: if you told your AI shopping assistant to buy shoes and it bought the wrong pair, your bank will probably see that as your purchase, not fraud.

That leaves three realistic routes:

• The merchant’s return policy, usually your best first move.
• A card dispute for non-delivery or a fake store. “Not received” and “not as described” are standard dispute reasons, whoever clicked.
• Local consumer law. In the UK, Section 75 of the Consumer Credit Act makes your credit card provider jointly liable for purchases between £100 and £30,000. UK and EU shoppers also get a 14-day right to cancel most online orders, with exceptions like personalised items, and it applies whether you or a bot clicked. In Canada, protections vary by province, and card zero-liability policies target fraud, not purchases you authorised.

The AI company usually sits outside the card dispute system. Its responsibility comes from its own terms of service, so read them first.

If an agent makes a purchase you didn’t want:

1. Revoke its access or token, or freeze the card.
2. Contact the merchant to cancel or return.
3. Call your card issuer straight away. For US debit cards, reporting within two business days keeps liability at $50.
4. Save chat logs, screenshots and order emails.

A Practical Guardrail Checklist: What to Automate and What to Keep Manual

The rule: the harder a purchase is to reverse, the more you should handle it yourself. Here’s how to split the work with your AI shopping assistant.

Task	Let AI handle it?	Why
Gift ideas, comparisons, review summaries	Yes	No money moves
Price tracking and drop alerts	Yes	You still decide
Reordering the same item from a store you use	Maybe, with a capped token	Known seller and product
Buying from an unfamiliar store	No	Highest fake-store risk
Custom, sized or final-sale items	No	Hard to return
Anything reached through an email or text link	No	Classic phishing route
Big-ticket purchases	No	A dispute would hurt

Before you let any AI shopping assistant near your money:

• Keep final confirmation on. Never switch off order approval.
• Use a separate card. A virtual, prepaid or low-limit card keeps mistakes small.
• Start with a cap you’d shrug off, such as the price of one routine order, and raise it only after weeks without surprises.
• Never paste your card number into a chat, and don’t let an AI browser use your autofill card.
• Turn on instant transaction alerts in your banking app.
• Check the seller name and web address before approving.
• Revoke access when you’re done.

The Agent Did Exactly What It Was Told

Think back to that fake Apple Watch order. The AI didn’t malfunction. It did precisely what it was asked, quickly and without hesitation. That’s the problem.

An AI shopping assistant follows instructions. It doesn’t get suspicious, and it has no money of its own to lose. So use it for what it does brilliantly: the searching, comparing and price watching that used to eat your evenings. Then keep your own thumb on the “Pay” button until the rules, the payment rails and the AI itself have earned more trust.

FAQ

Is it safe to give an AI my credit card?

Only through a tokenised, capped payment option from a recognised card network or checkout program. Never paste your raw card number into a chat or let an AI browser use your saved card. Before connecting any AI shopping assistant, consider a separate virtual or low-limit card.

Can an AI shopping assistant buy things automatically?

Yes. Some tools complete purchases inside the chat, and AI browsers can check out on ordinary websites. Most in-chat checkouts still ask you to confirm, and you should keep that step switched on.

Do AI shopping assistants show unbiased results?

Not necessarily. Some platforms earn a fee when you buy, some show labelled ads, and retailer-built tools recommend their own stock. Ask whether results are sponsored and compare with a second tool for important purchases.

What happens if an AI makes an unauthorized purchase?

Revoke the agent’s access, contact the merchant and call your card issuer immediately, keeping screenshots and chat logs. If you authorised the agent to shop, your bank may treat a wrong item as your purchase rather than fraud, so the return policy is often your best route.

Why are retailers blocking AI shopping bots?

Retailers cite security, fraud and account control. Critics argue they also lose ad revenue when agents skip promoted listings. Amazon’s lawsuit against Perplexity is the best-known example and is still ongoing.

How do I set guardrails for an AI shopping agent?

Keep manual confirmation on, use a separate card with a low cap, buy only from stores you know, turn on transaction alerts, check the seller name in the cart, and revoke access when finished.

Is an AI personal shopper worth it?

For research, yes. An AI shopping assistant saves real time on comparisons and price tracking. For hands-off buying, the convenience doesn’t yet outweigh the scam, bias and dispute risks for most people.