Can an AI agent actually buy anything for you?

Twelve of the 63 AI assistants catalogued here say they will spend your money. Two of them say how.

That gap is the whole argument, and this week two people had it in public while somebody else quietly ran into the wall it is about.

The argument

Shopify's president made the case that an agent buying something needs three things an ordinary website does not give it: a catalog to find the right product in, a trusted way to pay, and a checkout that completes reliably. He named Meta, Google, Microsoft and OpenAI as having built on exactly that.

The rebuttal came from an investor, and it is the sharper of the two.

The claim is that access was never the scarce thing. Every publicly reachable store is already available to an agent, whatever it runs on, so a catalog makes discovery faster without creating it. One-click checkout solves a problem agents do not have, because an agent is not annoyed by twelve form fields. And once the agent owns discovery, intent, identity and the interface, the money moves to whoever holds demand rather than whoever processes the card.

Both people have a position. One sells the rails. The other is describing what happens to the companies that sell them. Read them together or not at all.

What happened when somebody tried

Three days later, someone using Meta's assistant tried to order groceries.

This is the first sighting in this directory where an agent was stopped by the counterparty rather than by its own limits. Every other failure recorded here belongs to the product: it could not do the thing, or it did the wrong thing. This one did what it was asked and the shop would not take it.

That is a data point for the rails argument and not a conclusion. One person, one retailer, one attempt. But it is the only account anybody has published of the wall actually being hit, and it is on the retailer's side of it.

What the products claim, and what they show

Here is what a directory can add to an argument between two people who both have something to sell.

Twelve listings state payments as a capability, nearly a fifth of everything here, and 18 state bookings, which is the same act with the money left implicit. A substantial part of this market has decided that spending on your behalf is table stakes.

Two of those 12 name the rail. Both name Stripe: one of them alongside Plaid for the bank connection, the other having announced it the week this was written.

The other 10 state that they will buy things and do not say what happens when they do. Not which card, not who holds it, not what happens when the charge is wrong. If that sounds like an unfair reading, it is the same reading this directory applies to every other field: a blank means the product's own pages do not say.

The one itemised account

Exactly one company has published what its agent actually bought.

An $81 Japanese textbook for somebody who had always wanted to learn the language. Then $55 of whey protein. Then a $109 sunrise alarm clock. The argument attached to them is that buying something aspirational earns the right to buy something mundane later, which is a real claim about trust and is also marketing, and it comes from the company rather than from the three people.

It is still the most concrete thing anybody has said about agentic commerce, and that is the state of the evidence. Twelve products say they will spend your money, and the only itemised record of one doing it was published by a founder about his own product.

The part nobody is arguing about

Both sides of the public argument are about the merchant's side of the transaction: catalogs, checkout, who takes a cut. Neither addresses the buyer's.

If an agent buys the wrong thing, nothing in this directory says whose problem that is. The policy wall records what each product publishes about your data and none of them addresses a mistaken purchase. There is no recorded case of a refund, a dispute, or a chargeback initiated by software on somebody's behalf, and no product page we have read explains what happens when the agent is wrong and the card has already been charged.

A person who hands an agent a card is relying on a norm that does not exist yet. The rails argument is about whether the shop can take the order. The unasked question is what the shop does when the order should not have been placed.

What to watch

Three things, each visible from a field on this site.

The first is whether the 2 that name a rail becomes ten. Naming the rail is cheap, it is the single most reassuring thing a product could publish about spending, and the capability is recorded on every listing.

The second is whether a retailer publishes terms for agents. Somebody will be first to say what an agent may do on their site rather than blocking it or ignoring it, and the sighting above is the reason they will.

Last is whether anybody outside a company publishes what an agent bought them, with the amount. One founder's list of three is where the evidence stands. A second account from somebody with no stake in it would tell us more than either half of the argument above.