A wallet designed around delegated action
OpenAI has introduced ChatGPT Wallet, a payment product designed to let an AI agent complete a purchase without receiving the user’s actual card details. The first rollout is through dots for eligible ChatGPT Pro subscribers aged 18 or older in the United States with supported US-issued cards. American Express, Mastercard and Visa are launch partners, positioning the wallet as an extension of existing payment rails rather than a separate currency or closed merchant network.
The timing is significant because conversational product discovery is moving towards action. OpenAI says 1.2 billion people use ChatGPT each week, many to research and compare products. A wallet changes the assistant from an advisory surface into a participant in checkout. That raises the value of accurate product data, but it also raises the cost of errors: a misleading recommendation can now become an authorised transaction unless the approval experience makes price, seller and conditions unambiguous.
OpenAI’s initial design keeps a person in the loop for every purchase. A user adds a card once, reviews the items, total and selected card, then approves with a security check such as Face ID or a fingerprint. The approval creates a record of what the user authorised. This is a stronger boundary than allowing an agent to reuse a stored credential silently, although its effectiveness will depend on whether the review screen exposes shipping, subscriptions, returns and other material terms.
Tokens and approval define the trust boundary
After approval, the payment network supplies a token containing substitute payment credentials. Neither the business nor the agent receives the underlying card number. The purchase is still made directly from the customer to the merchant, and eligible card rewards and dispute protections remain. Merchants retain responsibility for pricing, fulfilment, returns and service. That familiar allocation is useful because businesses do not need to adopt an entirely new settlement system to recognise an agent-assisted customer.
Tokenisation limits credential exposure, but it does not eliminate fraud or mistaken intent. A compromised account could still assemble a convincing basket, while a poorly configured agent could select the wrong size, seller or delivery address. Teams evaluating agentic commerce should distinguish payment security from purchase correctness. Strong authentication can prove that a person approved a screen; it cannot prove that the agent’s research was complete or that the user understood every downstream consequence.
OpenAI is also publishing a Commerce Partner Playbook for businesses. It recommends claiming and verifying business information in ChatGPT, keeping product feeds current and ensuring agents can reach websites. Sites can use Web Bot Auth to recognise signed agent requests instead of treating all automation as hostile traffic. This creates a practical balancing problem for security teams: permit legitimate agent access without opening checkout, inventory or account endpoints to generic scraping and automated abuse.
Businesses must prepare existing systems
Payment and risk systems may also reject legitimate agent purchases because their behaviour differs from a conventional browser session. OpenAI says it is working with fraud specialists including Forter, Riskified, Sardine and Signifyd, alongside payment providers such as Adyen, Checkout.com and Stripe. Merchants should test decline codes, step-up verification, refunds and support escalation. A purchase that passes technically but cannot be explained to a customer will damage trust faster than an ordinary checkout failure.
Businesses can expose richer actions through plugins or WebMCP tools, such as checking availability or managing a cart. Those interfaces need narrower permissions than a human-facing website. An agent should receive only the fields and actions required for the task, with idempotency controls so retries do not create duplicate orders. Every state-changing call should produce an audit record that connects the request, displayed terms, user approval and final merchant response.
OpenAI says future versions could allow users to pre-authorise purchases within spending limits, categories or time windows. That would make agents more autonomous, but it also changes the risk model. A safe delegation needs revocation, cumulative limits, merchant restrictions, alerts and clear rules for ambiguous products. The system must fail closed when instructions conflict. ‘Buy household essentials under $100’ is not adequate authority for subscriptions, age-restricted goods or unfamiliar marketplace sellers.
The larger test is accountable delegation
ChatGPT Wallet is therefore less a story about storing a card than about constructing evidence for delegated intent. Its early rollout gives OpenAI, banks and merchants a chance to observe real failure modes while every purchase still requires a person’s confirmation. Success should be measured through erroneous orders, dispute rates, false declines and support outcomes, not transaction volume alone. Australian businesses should watch the US pilot closely because the integration lessons will travel even where consumer law, authentication and dispute rules differ. If the approval and audit model holds, the wallet could become useful infrastructure for agents; if it obscures responsibility, convenience will not compensate for lost trust.