Shopping agents can read the secrets they promise to protect

When venture capitalist Yuechen Zhao asked Instinct to find a hotel, the agent offered to complete the Booking.com form if he stored his card details in its credential vault. The interface said the agent would not see the sensitive data. Zhao entered a fake card number, then challenged the system to retrieve it. The agent acknowledged that it could execute JavaScript on the page and read the card number and passwords back in plain text.

Instinct told The Information that users remain in control and protecting their data is a priority. The experiment does not establish that customer cards have been stolen. It does demonstrate that a promise made in the interface can differ from the authority held by the browser agent: software capable of filling forms, reading pages and clicking through checkout may also be capable of crossing the boundary around the vault.

Payment companies are building compensating controls. Stripe can issue Muse agents a single-use virtual card capped at the approved purchase; Visa and Mastercard are creating registries that distinguish recognized agents from ordinary bots; Mastercard’s “verifiable intent” records what a user authorized so a bank can later evaluate a disputed charge. These mechanisms move protection outside the model and make authority narrow, temporary and auditable.

The unresolved problem is liability. If an agent buys the wrong item, a customer may seek a chargeback while the merchant argues that the instruction was valid. Merchants also lose behavioural data when an outside agent bypasses their site. Only 7% of fashion shoppers in an ACI Worldwide/YouGov survey said they trusted AI to purchase without approval. Agentic commerce will therefore depend less on fluent shopping recommendations than on boring infrastructure: scoped credentials, explicit final consent and evidence showing exactly who authorized what.