Can an AI agent actually buy anything for you?

Twenty-five of the 90 AI assistants catalogued here say they will spend your money. Eight of them say how.

That gap is the whole argument, and this week two people had it in public while somebody else quietly ran into the wall it is about.

The argument

Shopify's president made the case that an agent buying something needs three things an ordinary website does not give it: a catalog to find the right product in, a trusted way to pay, and a checkout that completes reliably. He named Meta, Google, Microsoft and OpenAI as having built on exactly that.

The rebuttal came from an investor, and it is the sharper of the two.

The claim is that access was never the scarce thing. Every publicly reachable store is already available to an agent, whatever it runs on, so a catalog makes discovery faster without creating it. One-click checkout solves a problem agents do not have, because an agent is not annoyed by twelve form fields. And once the agent owns discovery, intent, identity and the interface, the money moves to whoever holds demand rather than whoever processes the card.

Both people have a position. One sells the rails. The other is describing what happens to the companies that sell them. Read them together or not at all.

What happened when somebody tried

Three days later, someone using Meta's assistant tried to order groceries.

This is the first sighting in this directory where an agent was stopped by the counterparty rather than by its own limits. Every other failure recorded here belongs to the product: it could not do the thing, or it did the wrong thing. This one did what it was asked and the shop would not take it.

That is a data point for the rails argument and not a conclusion. One person, one retailer, one attempt. But it is the only account anybody has published of the wall actually being hit, and it is on the retailer's side of it.

What the products claim, and what they show

Here is what a directory can add to an argument between two people who both have something to sell.

Twenty-five listings state payments as a capability, nearly a fifth of everything here, and 32 state bookings, which is the same act with the money left implicit. A substantial part of this market has decided that spending on your behalf is table stakes.

Eight of those 25 name the rail. Both name Stripe: one of them alongside Plaid for the bank connection, the other having announced it the week this was written.

The other 17 state that they will buy things and do not say what happens when they do. Not which card, not who holds it, not what happens when the charge is wrong. If that sounds like an unfair reading, it is the same reading this directory applies to every other field: a blank means the product's own pages do not say.

The one itemised account

Exactly one company has published what its agent actually bought.

An $81 Japanese textbook for somebody who had always wanted to learn the language. Then $55 of whey protein. Then a $109 sunrise alarm clock. The argument attached to them is that buying something aspirational earns the right to buy something mundane later, which is a real claim about trust and is also marketing, and it comes from the company rather than from the three people.

It is still the most concrete thing anybody has said about agentic commerce, and that is the state of the evidence. Twenty-five products say they will spend your money, and the only itemised record of one doing it was published by a founder about his own product.

The part nobody is arguing about

Both sides of the public argument are about the merchant's side of the transaction: catalogs, checkout, who takes a cut. Neither addresses the buyer's.

If an agent buys the wrong thing, nothing in this directory says whose problem that is. The policy wall records what each product publishes about your data and none of them addresses a mistaken purchase. There is no recorded case of a refund, a dispute, or a chargeback initiated by software on somebody's behalf, and no product page we have read explains what happens when the agent is wrong and the card has already been charged.

A person who hands an agent a card is relying on a norm that does not exist yet. The rails argument is about whether the shop can take the order. The unasked question is what the shop does when the order should not have been placed.

What to watch

Three things, each visible from a field on this site.

The first is whether the 8 that name a rail becomes ten. Naming the rail is cheap, it is the single most reassuring thing a product could publish about spending, and the capability is recorded on every listing.

The second is whether a retailer publishes terms for agents. Somebody will be first to say what an agent may do on their site rather than blocking it or ignoring it, and the sighting above is the reason they will.

Last is whether anybody outside a company publishes what an agent bought them, with the amount.

It resolved a day after this piece went up. Somebody with a large audience and no stake in any of it described asking Muse for a green puffer jacket, then watching it find live discount codes, apply them at checkout and buy at the cheapest price it could reach. He also had it load a Whole Foods cart from a recipe.

No amount, which is the one thing still missing. What it is, though, is an outside account of a purchase completed end to end rather than a founder's list. Both sit on the buying page with everything else anybody has published about an agent spending money.

An amount arrived two days later, and with it a question this piece had not asked. An investor who uses Instinct daily wrote that he had bought thousands of dollars through it, "some of which I've chosen and asked for and some of which it's offered to me". That is the first outside account of an agent proposing a purchase rather than executing one. Nothing Instinct publishes says whether it is paid when you accept.

The same week, a first-day account of Muse recorded four purchases that stalled. An account the agent did not hold. A catalogue price a day stale. A delivery date worse than the app's own. A login the platform would not let it finish. Both accounts are on the market wall, and the second is the more useful, because it is a list of what stops an agent from buying, from somebody who wanted it to.

The layer underneath moved on the same day. Kernel, the browser infrastructure two listings here already name, said agents running on it can complete a checkout using a card alias. The real credential is substituted only as the request leaves the environment, so a card number never enters the agent's runtime or its context.

Stripe, Stripe Link and Agentcard are the wallets named at launch; Agentcard is a listing of its own now, and it names two of the products here as customers. It is the credential problem the rest of this site keeps running into, solved one layer down: the products above argue about whether to hold your password, and this removes the question by never letting the secret reach the part that can be talked into things. Nothing in the directory has said it uses it.