Conceptual editorial illustration of an open workbench holding product data cartridges, a brass payment token and a merchant ledger, with a single checkout form carried along a rail through a gated aperture towards a distant amber hall, labelled BUILD and PARTNER ACCESS.

Selling through AI agents: open to build, not open to all

October 30, 2026 Alex Mercer

Building with the Agentic Commerce Protocol is open to anyone. Offering Instant Checkout inside ChatGPT is not. OpenAI’s developer documentation draws that line clearly, and it is a useful starting point for merchants asking what selling through an AI shopping agent actually involves.

Instant Checkout is a live checkout experience inside ChatGPT, which the documentation says is available to approved partners. A merchant can therefore do the engineering work and still have no route into the channel. The available material does not set out the approval criteria or a full partner list.

What a merchant has to build

The documented work starts with product data. Supporting Instant Checkout requires a secure, regularly refreshed feed in CSV or JSON, carrying identifiers, descriptions, pricing, inventory, media and fulfilment options.

The checkout is split between the two sides. OpenAI’s interface renders the session, but checkout state and payment processing stay on the merchant’s systems. The merchant accepts or declines the order, charges the payment method through its existing processor and confirms it. The customer-facing moment is in ChatGPT; the commercial decision is not.

Payments follow the same division. Under the Delegated Payment Spec, OpenAI can share payment details with the merchant or its payment service provider. Stripe’s Shared Payment Token is the first compatible implementation, and OpenAI states that it is not the merchant of record. Order handling and payment collection therefore remain merchant responsibilities.

The authority question moves to payments

Agent payment standards are approaching the same problem from another direction. FIDO Alliance announced on 29 April 2026 that Google had donated the Agent Payments Protocol and published AP2 version 0.2. The update added Human Not Present payments, allowing an agent to buy from instructions the user pre-authorised. FIDO said the transfer was meant to keep AP2 platform-agnostic.

That is a governance announcement, not proof of deployment or security. It confirms that the industry is designing for transactions where the person is absent when payment happens. The practical questions are what limits apply, how quickly authority can be revoked and how a merchant can tell who is behind the agent.

ACP’s delegated payment model assumes similar pre-authorisation. Neither the documentation nor the standards announcement shows how well those controls work in live commerce.

Interest is not completed use

Riskified, a fraud and risk intelligence vendor, reported that its September 2026 survey of 5,100 consumers found 80 per cent had used AI somewhere in shopping and 74 per cent would allow agentic purchases in some form. Only 11 per cent had completed a purchase inside an AI tool; 7 per cent were comfortable letting AI buy without approval.

Retail Insider, reporting on Checkout.com’s Agentic Commerce 2026 report, said 3 per cent of transactions involve AI agents, while 89 per cent of merchants were preparing for wider adoption. Censuswide surveyed 12,005 consumers across the UK, US, Brazil, China, France and the UAE, plus 400 payment heads at UK and US merchants.

Riskified counted consumers who completed a purchase in an AI tool; Checkout.com counted transactions involving agents. Different units, samples and definitions make a single adoption rate misleading. Both are vendor-reported or relayed second-hand. They point to interest and preparation ahead of completed purchases, not a settled market.

Control is the condition of trust

Riskified reported that 43 per cent want to approve every purchase, while 29 per cent would allow automatic buying within rules they set. Retail Insider reported that Checkout.com’s respondents would allow an average of 177 pounds per purchase without further approval, against a merchant expectation of 200 pounds. Spending limits, instant revocation of permissions and easy cancellation were among the most important conditions. Three quarters of merchants said real-time revocation would be critical.

Those are stated preferences, not observed behaviour. They still show where design pressure sits: a working checkout is not enough without a visible boundary around what the agent may do and a simple way to withdraw authority.

Refunds, identity and unresolved liability

Riskified reported that 51 per cent of consumers said the AI platform should issue refunds when AI makes an error, while 68 per cent want to know when they are dealing with an agent rather than a human. Those are expectations, not findings about legal liability.

Riskified also said the terms for Muse and Instinct place responsibility for agent actions on users, but the terms themselves were not available, so that remains an unverified vendor claim. Its chief marketing officer, Jeff Otto, described blame directed at an agent as a coming refund-abuse risk and said merchants must distinguish a real customer using a legitimate agent from a hijacked account or malicious automation. That is a fraud vendor’s prediction, not evidence of a specific incident.

The deployment picture is still contested

A July 2026 Zenodo analysis argued that promotion was running ahead of delivery and claimed that OpenAI discontinued Instant Checkout in March 2026. The analysis discloses that an Anthropic model assisted its author and that Anthropic is a market participant. It also argued that shopping agents are not neutral, citing selection bias and prompt injection in product content as ways a purchase could be redirected. Those claims remain the analysis’s own; the underlying studies are not independently verified.

OpenAI’s documentation describes Instant Checkout as available to approved partners. Canaan commentary in September 2026 described it as live for more than a million Shopify merchants, a scale figure not independently verified. The available evidence does not resolve whether a discontinuation happened and was reversed, or whether the Zenodo claim is wrong. The conflict remains open.

What the evidence supports

The documented build is a product feed, an integration that keeps order acceptance and payment processing on merchant systems, and a payment route through a provider. Live distribution depends on partner approval. Surveys show interest; completed agentic purchases remain a small share of activity. The surveyed markets do not include Australia, so local implications remain unclear.

The next useful facts would be clearer partner criteria, transaction data from merchants actually live in agentic channels, and terms that say who bears the cost when an agent errs. Until then, the evidence supports treating agentic commerce as a set of integration choices with uneven access, not a channel every merchant can already switch on.

A delegated payment token is a compact claim about authority: someone permitted an agent to spend on their behalf, within limits, until they withdraw it. Working out what such a token actually attests, and what it leaves the merchant to verify, is where cryptography stops being abstract, because it is the study of how keys, signatures and credentials carry trust between parties who never meet. The article’s documentation is candid about the gap, describing pre-authorisation without showing how limits hold in practice or how swiftly authority can be pulled back. Reading a token for what it proves, rather than what it is said to enable, is a habit worth building deliberately, and The Hack Academy’s online cybersecurity training programme lists cryptography among its subject areas, with self-paced learning and practical exercises alongside the theory.