AI Can Spend Your Money Before Anyone Knows Who’s Liable
Card networks have spent the past two years building payment rails for software that shops on your behalf. Visa and Mastercard both run agent payment frameworks, and American Express offers purchase protection for registered agents. The question has moved from whether an AI will hold your card to what happens the first time it uses it badly. Several of these failures are already documented in security research or argued in court. Here's 20 ways it goes wrong.
1. Hidden Text On A Page Gives Your Agent Orders
Guardio's researchers hid instructions in a captcha page using CSS, telling the agent the captcha was AI-friendly and should be clicked. The agent clicked. The payload was harmless in the demo and did not have to be.
2. A Fake Storefront Takes The Card
Guardio built a counterfeit Walmart site from a single prompt and told Perplexity's Comet browser to buy an Apple Watch. In some runs the agent added the item, autofilled the saved address and card, and completed checkout without asking.
3. A Phishing Email Becomes A To-Do Item
In the same tests, Comet received a fake Wells Fargo email from a new ProtonMail address. It treated the message as a task, clicked through to a page Google Safe Browsing had not flagged, and helped fill in the credential form.
4. The Dispute Rules Do Not Cover Wrong Item
Fraud follows existing tokenized-transaction rules, so your chargeback rights survive. Everything short of fraud is unsettled. Regulation E assumes a payment was either authorized or not, with no category for an agent buying the wrong thing, and merchants and agent platforms are still arguing over who eats it.
5. Nobody Can Prove What You Authorized
Issuers tend to side with the cardholder when no signed mandate records the instruction. That cuts both ways, since my agent went rogue works as friendly fraud and merchants have nothing to contest it with.
6. The Retailer May Not Allow Agents At All
Amazon sued Perplexity in November 2025 over Comet disguising automated sessions as ordinary Chrome traffic. A federal judge granted a preliminary injunction blocking the agent from making Amazon purchases for users.
7. Your Account Data Ends Up Somewhere Else
The same injunction ordered Perplexity to stop accessing password-protected Prime accounts and destroy Amazon customer data already collected through Comet. Users had granted permission, and the court found that permission was not Amazon's to give.
8. European Authentication Rules Can Stop The Transaction
Strong Customer Authentication under PSD2 was designed around a human confirming a payment in the moment. Agent transactions can fail that test outright, and regulators have not committed to clarifying the position.
9. It Signs Up For Recurring Billing
A single purchase decision can commit you to a subscription with a renewal date and a cancellation flow. The agent that bought it has no reason to revisit the charge. Cancelling is a separate task that nobody assigned.
10. A Standing Instruction Grows Teeth
Keep the pantry stocked sounds bounded until a price drop, a bulk listing or a supply warning enters the reasoning. Open-ended instructions have no natural ceiling unless you set one in dollars.
11. A Timeout Produces Two Orders
Agents retry failed requests. When the first attempt actually succeeded and the confirmation page merely timed out, the retry buys the same thing again, and the duplicate surfaces at delivery rather than at checkout.
12. It Pays A Merchant That Does Not Exist
Models invent product codes and sellers that look plausible. A payment sent on that basis goes to whoever happens to hold the account details, and the order never arrives because there was no order.
13. It Picks A Payment Rail With No Way Back
Cards carry dispute rights. Bank transfers and gift card codes mostly do not, and an agent optimizing for a lower fee will choose the rail that leaves you nothing to reverse. Scam sellers favor those same rails.
14. The Recommendation Is Paid Placement
Shopping agents sit on commercial arrangements that users never see. The question of whether your assistant found the best price or the best-compensated one is invisible from inside the conversation.
15. Merchants Price Differently For Machines
Sites can already detect automated sessions, which is how Amazon identified Comet. Detection enables a surcharge, a worse offer or a quiet block, and your agent reports back the price it was shown.
16. The Spend Loop Runs All Night
Metered API calls and paid tool access bill by use. An agent in a retry loop against a failing endpoint spends real money for hours before a budget alert catches up with it.
17. One Bad Instruction Gets Remembered
An agent with persistent memory saves preferences and repeats them. An instruction absorbed from a poisoned page or a one-off mistake comes back on every future run, which makes a single compromise recurring.
18. Two Agents Negotiate Themselves Into Trouble
Pricing software coordinating across sellers has already drawn antitrust attention. Agents bargaining with agents at scale raises the same question from the buyer's side. No case has tested how that looks to a regulator.
19. Your Agent Hires Its Own Help
One task can expand into paid tool calls and sub-agents of its own. Each step looks reasonable by itself, and the bill arrives as a single number with no obvious line to query.
20. The Receipt Does Not Explain Anything
Reconstructing why a purchase happened means reading a reasoning trace that may not have been stored. Without that record, you are disputing your own instruction and guessing at what the agent believed you meant.
