Summary
OpenAI has introduced ChatGPT Wallet, allowing a limited group of U.S. users to authorize ChatGPT agents to help select products and complete purchases through existing payment cards rather than crypto. At the same time, Sierra’s Personal Agent Protocol is giving merchants and personal agents a common language for identity, permissions and customer approval.
The wallet is really an authorization layer
OpenAI’s launch of ChatGPT Wallet moves ChatGPT beyond recommending products or answering questions and into the execution of a real consumer transaction. Under the feature described in the source material, eligible users can add a payment card to ChatGPT Wallet and ask a ChatGPT agent to help with a purchase. The agent can assist with product selection and the checkout process, but the user is expected to review the items, the total and the card that will be charged before the transaction is completed.
That distinction matters. The product is not simply giving an AI model an unrestricted virtual card. Instead, it separates several steps that are often bundled together in a conventional online checkout: discovery, comparison, selection, payment preparation and final approval. The agent can handle the repetitive work, while the user remains responsible for confirming the specific transaction.
The initial rollout is limited to a group of U.S. ChatGPT Pro subscribers who are at least 18 years old and have a U.S.-issued Visa, Mastercard or American Express card. Before a purchase is completed, users must approve it through a security check such as Face ID or a fingerprint. That approval creates a record of the transaction, according to the information provided about the launch.
This model places the user visibly in the loop. It also reflects a central challenge for agentic commerce: an agent may be able to understand a natural-language request, but that does not mean it should have unlimited authority to spend, change an order or make a decision that the user did not explicitly anticipate.
A traditional payment rail, not a crypto wallet
Despite the Wallet name, ChatGPT Wallet is described as a conventional payment-card feature rather than a cryptocurrency wallet. Users add eligible cards, and the system uses a payment token to charge the selected card. The token substitutes for the actual card details, which are not shared directly with the agent or the merchant, according to the source material.
The use of tokenization addresses one important security concern. An agent does not need access to a reusable card number in order to participate in a checkout flow. If designed and implemented correctly, that can reduce the consequences of exposing payment credentials to a model, an external service or a merchant environment.
Tokenization does not, however, resolve every risk associated with agentic payments. A token can limit the exposure of card data, but it cannot by itself determine whether an agent correctly understood the user’s request. It also cannot decide whether a change in quantity, product, delivery address or payment amount requires fresh approval. Those questions belong to the authorization and control layer surrounding the payment.
This is one reason the launch is notable even without a crypto component. The next phase of digital-wallet development may focus less on introducing a new asset and more on giving software a controlled way to use existing financial infrastructure. Card networks, merchant systems and established dispute mechanisms provide a familiar foundation, but they must now accommodate a software intermediary that can interpret instructions and act across several services.
Poppy addresses the merchant side of the problem
OpenAI’s wallet focuses on the transaction and user-approval side of agentic commerce. Sierra’s Personal Agent Protocol, known as Poppy, addresses a different problem: how personal agents and companies should communicate when an agent visits a business website or service.
Sierra has released version 1.0 of the protocol, which allows a company to tell an incoming agent who it is and what the agent is permitted to do. Examples include checking an order or booking a flight. Users sign in through standard login systems and decide what their agent can access. The aim is to replace some of the guesswork involved when an agent navigates a website designed primarily for human users.
The source material says Shopify has enabled Poppy across its stores, while Meta’s Muse agent now looks for the protocol first when visiting sites. Sierra says more than 100 companies have signed up or participated, including Delta Air Lines, Intuit, Salesforce and Zoom. Some use cases are already live. Mercury allows agents to check balances and initiate payments, while those payments remain subject to the account’s approval rules. Turkish Airlines allows agents to check fares and identify business-class upgrade options, with the customer approving the payment before it is made.
Shopify’s role illustrates how different pieces of the stack can fit together. Poppy can handle the initial interaction in which an agent identifies itself and learns what a merchant supports, while Shopify’s existing shopping protocol handles carts and checkout. The agent still has to ask the shopper before carrying out certain actions.
A common protocol could make it easier for merchants to support multiple agents without building a separate integration for each one. It could also give agents a structured way to learn a company’s capabilities instead of relying on visual page interpretation, which can be fragile and vulnerable to misleading instructions.
Standards are useful, but they are not complete governance
Poppy is still labeled a draft, even though the release is called version 1.0. The specification may change in ways that affect compatibility. More fundamentally, a protocol can describe what an agent is allowed to do, but it cannot independently determine whether a particular action is appropriate in context.
That gap creates several unresolved questions. How does a merchant verify that an agent is acting for the user it claims to represent? How long should an authorization remain valid? Can an agent move from checking an order to changing it without another confirmation? What happens if a model misreads a request, follows malicious instructions embedded in a webpage or submits an order twice? Which party is responsible when a product is charged correctly but selected incorrectly?
These are not merely technical edge cases. In an agentic transaction, a customer may interact with a model, a wallet, a payment provider, a merchant and a fulfillment service, all within a single workflow. Each party may retain a different part of the audit trail. A dependable system therefore needs more than a successful payment response. It needs records of the user’s instruction, the agent’s interpretation, the permissions available at the time, the data presented before checkout and the final approval event.
For institutional wallets, custody platforms and enterprise payment systems, the same principle applies even when the asset is not a consumer card. An agent should not be treated as an all-purpose credential holder. It is better understood as an operational actor with narrowly defined permissions, separate approval requirements and continuous monitoring. Reading a balance, preparing a transaction and authorizing a transfer should not automatically be treated as the same capability.
Consumer adoption will depend on trust, not only convenience
The commercial opportunity is clear: agents could reduce the time spent searching, comparing and entering information across multiple merchant sites. But early adoption signals are mixed. The source material notes that DoorDash and Uber have reported relatively low numbers of orders placed by AI agents, while Meta’s Muse, which has more than 10 million users, has seen AI-assisted shopping become a leading activity on its app.
That contrast suggests that consumers may be comfortable using AI to discover and evaluate products before they are comfortable delegating the final purchase. The difference between assistance and execution is significant. A mistaken recommendation is inconvenient; an incorrect or repeated charge is a financial and customer-service problem.
Merchants will also need to present information in a form agents can interpret reliably. Prices, availability, shipping terms, cancellation rules, substitutions and refund conditions all need to be clear. If an agent makes a decision based on incomplete or ambiguous information, the resulting dispute may be difficult to assign to a single party.
Payment providers and wallet operators will likewise have to combine tokenization with step-up authentication, transaction limits, permission scopes and anomaly detection. The goal is not simply to prevent card numbers from leaking. It is to ensure that the software can act quickly without gaining more authority than the user intended to grant.
The next phase is coordination across the stack
ChatGPT Wallet and Poppy represent two complementary pieces of agentic commerce. One focuses on how a user authorizes an AI agent to complete a payment. The other focuses on how an agent identifies itself and discovers what a merchant allows. Neither piece, on its own, creates a complete standard for autonomous purchasing.
The industry will need clearer conventions for agent identity, user consent, payment tokens, audit records, refunds and liability. It will also need practical ways for users to understand and revoke permissions without navigating a complex security interface.
For now, the most significant development is not that an AI can click through checkout. It is that consumer AI companies, merchants and payment providers are beginning to define the boundaries around that action. If those boundaries remain visible, limited and auditable, agentic shopping may evolve from a convenience feature into a more dependable layer of digital commerce. If they remain vague, the same automation that removes friction from checkout could also make errors and unauthorized actions harder to detect and resolve.
Source: link