Can AI Agents Book Flights, Buy Products and Make Payments?

Yes in a few guarded places, no for most flights, and “it depends” for payments. As of November 2026, AI agents can make purchases through a handful of live US checkout surfaces (Google’s Universal Cart, merchant checkouts reached from ChatGPT) and the card networks have shipped the rails for agent-initiated payments. But Delta and most airlines still block third-party agents, Amazon refuses them entry, and no major retailer lets an unverified agent complete a purchase on its site.

What follows splits what has actually shipped from what is only announced or in pilot. That gap is where most of the confusion lives.

What can AI agents actually buy for you right now?

Three consumer surfaces shipped real checkout by late 2026, and all of them are narrower than the demos suggest. Agentic commerce is commerce where an AI agent (not a human with a mouse) performs the shopping steps, and right now it mostly means “the agent helps, you still confirm.”

Here’s what is genuinely live:

• Google Universal Cart, launched in the US on October 15, 2026, works across Google Search (including AI Mode) and the Gemini app. It’s a multi-retailer cart with price tracking and inventory alerts, and you pay through Google Pay (Google blog).
• UCP checkout (Google’s Universal Commerce Protocol, announced January 11, 2026 and co-developed with Shopify, Etsy, Wayfair, Target and Walmart) powers a checkout button on eligible product listings in AI Mode and Gemini. The retailer stays the merchant of record, meaning the shop you’re buying from keeps the legal seller duties: taxes, fulfillment, refunds (Google blog).
• ChatGPT remains a shopping assistant more than a cashier. After scaling back native Instant Checkout in March 2026, it now leans on shopping research, retailer apps (Expedia and Booking.com arrived in October 2025) and “Shop at” links that hand you to the merchant to pay.
• Amazon’s “Buy for Me” agent buys from other brands’ sites on your behalf, while blocking outside agents from amazon.com, a double standard critics flagged in CNBC’s November 2026 report.

Notice the pattern. In every shipped feature, a trusted payment intermediary (Google Pay, a tokenized card) sits between the agent and your money, and the merchant keeps its normal role. The “agent roams the web and buys whatever it wants” version is still mostly a slide deck.

Can an AI agent book flights for you?

For third-party agents, effectively no. Delta has no third-party booking integration and blocks AI agents from browsing fares and completing bookings, per The Verge’s October 17, 2026 report, and it’s not alone in travel. Airlines see two problems: bots “seat spinning” (holding inventory via booking interfaces without paying) and agents that strip out upsells and the direct customer relationship.

The travel apps inside ChatGPT make the limits obvious. Expedia, Booking.com and TripAdvisor were launch partners for OpenAI’s apps platform in October 2025, and you can search hotels, compare flights and see maps in-chat, but the transaction is completed on those companies’ own sites, and the apps aren’t available in the EU (PhocusWire).

So the honest answer is: an agent can plan your trip and find the fare, and in 2026 a human clicks the buy button. Hotel bookings can be started in ChatGPT through Booking.com, Expedia or brand apps, but the same handoff applies. If a tool claims to book Delta flights for you autonomously, that claim doesn’t match how Delta says it treats agents.

Which checkout protocols actually shipped?

Four ecosystems are real, and only two have consumer-facing rollouts. The rest are specifications waiting for adoption.

Protocol / program	Who’s behind it	Status (November 2026)	Where it’s actually live
Agentic Commerce Protocol (ACP)	Stripe + OpenAI	Shipped and open source; native Instant Checkout scaled back March 2026	Merchant handoffs and apps inside ChatGPT (US)
Universal Commerce Protocol (UCP)	Google, co-developed with Shopify, Etsy, Wayfair, Target, Walmart	Shipped	Checkout in AI Mode and Gemini; Universal Cart (US, since Oct 15, 2026)
Agent Payments Protocol (AP2)	Google + 60+ partners incl. Amex, Mastercard, PayPal, Adyen	Spec v0.2, donated to the FIDO Alliance for standardization	Reference implementations and pilots; no consumer surface
Mastercard Agent Pay	Mastercard (+ Microsoft, IBM, banks)	Shipped via certified processors; Agent Pay for Machines in early access (June 2026)	Agentic Tokens usable at Mastercard-accepting merchants
Visa Intelligent Commerce + Trusted Agent Protocol	Visa (+ OpenAI, Microsoft, Anthropic, Stripe)	Live framework; TAP spec public; first pilot live	B2B invoice-payment pilot with BILL and Billtrust (Oct 2026)

Two things stand out from that table. First, the payment plumbing matured faster than merchant access. Second, “open protocol” doesn’t mean “working product”: AP2’s own spec site shows version 0.2 with standardization continuing in FIDO Alliance working groups, which is progress, not a rollout.

The money isn’t small. Juniper Research forecast in April 2026 that global agentic commerce transaction value would grow from $8 billion in 2026 to $1.5 trillion by 2030, naming Mastercard, Visa and Stripe as the infrastructure leaders (Juniper Research).

Agentic commerce is forecast to jump from $8 billion in transaction value in 2026 to $1.5 trillion by 2030. Juniper Research, April 2026.

Forecasts like that describe rails being laid, not shopping happening today. The 2026 reality is pilots, partner flows and one live multi-retailer cart.

How do agent payments actually work?

Two mechanisms dominate, and they’re converging. Tokenization replaces your real card number with a scoped stand-in, and mandates add a signed record of what you actually authorized.

The networks tokenize. Mastercard Agent Pay, announced April 29, 2025, issues Agentic Tokens: programmable tokens that bind a payment credential to a registered, verified agent and carry spending rules, with the issuer able to see that an agent facilitated the transaction (Mastercard). Visa’s Intelligent Commerce, announced April 30, 2025, tokenizes cards uploaded through payment passkeys so the real number never touches the agent or merchant (Visa). Stripe’s Shared Payment Token, built for ACP, is scoped to a specific merchant and basket total, so a leaked token buys one thing, not everything.

AP2 adds the paperwork. A purchase becomes two cryptographically signed verifiable credentials: an Intent Mandate (your constraints, such as a price limit) and a Cart Mandate (the exact items and price), chained into what Google calls a non-repudiable audit trail (Google Cloud). The design exists to answer three questions Google laid out: did the user authorize this specific purchase, is the agent’s request faithful to their intent, and who’s accountable when it goes wrong.

The unstated fourth question is who blocks the transaction, and that’s where 2026 got interesting. Visa combined its Intelligent Commerce framework with the Trusted Agent Protocol (a cryptographic way for merchants to distinguish legitimate agents from bots, published in October 2025) and put the first live agentic payments pilot into production for B2B invoice payments with BILL and Billtrust in October 2026 (Visa press release). Mastercard went the other direction on scale, launching Agent Pay for Machines in June 2026 for machine-to-machine payments across cards, bank accounts and stablecoins (Mastercard).

Where agents still get stopped

Bot walls, CAPTCHAs, bank rules and now court orders. The open web spent 2026 closing doors faster than protocols opened them.

The scale of accidental blocking surprised me. An audit cited by CNBC of 51 large US retailers found 37 block shopping agents unintentionally through older anti-scraper rules; only 11 had taken a deliberate position; and none allow a verified agent to complete a purchase (CNBC). Beyond retail, JPMorgan Chase, Amazon, Charles Schwab, Kohl’s and Neiman Marcus explicitly restrict agents, while Delta, Yelp and Amazon also feature in The Verge’s survey of sites where agents hit walls. Target, running AI shopping partnerships, is the counterexample.

Courts weighed in too. Amazon sued Perplexity in November 2025 over Comet’s agentic shopping, and on March 10, 2026 a federal judge granted Amazon a preliminary injunction blocking Comet from shopping on Amazon: an early test of whether user-authorized agents can ignore a site’s bot prohibitions (GeekWire). Meanwhile CAPTCHAs remain a hard stop: agents halt mid-task awaiting a human, which is why AWS previewed “Web Bot Auth” cryptographic agent identity in late 2025.

Banks are the newest front. Axios reported on October 22, 2026 that major US banks are detecting unvetted AI agents operating inside customer accounts using legitimate customer credentials (no hack involved) and are blocking them because agent access without approval violates account terms. A middle ground under discussion: view-only access for vetted agents (Axios). OpenAI’s own design reflects the same caution: when the 2025 ChatGPT agent hit a payment or login step, it handed control back to you, and that agent has since been folded into ChatGPT Work, the agent mode OpenAI launched on July 9, 2026 (MacRumors).

Who’s liable when an agent buys the wrong thing?

Nobody has fully answered that yet, and that’s the honest headline. Here’s how it shakes out in practice as of November 2026:

• The merchant keeps merchant-of-record duties. In ChatGPT purchases, OpenAI’s model made merchants responsible for orders, fulfillment, refunds and support from day one (OpenAI), and no OpenAI-backed buyer guarantee program has taken its place since the checkout pivot.
• Disputes run through ordinary card rules. A botched agent purchase is treated like any other card-not-present dispute, so you retain chargeback rights when an agent acts outside your instructions (Chargeflow).
• “Authorized” is the gray zone. US Regulation E protects consumers from unauthorized electronic transfers, but whether an agent acting on vague instructions counts as authorized is unresolved (Backbase). US banks published positions in October 2026, and per Axios coverage, almost all of them say the liability isn’t theirs.

Mastercard’s Agent Pay materials commit to a process for clarifying agentic transactions that may be unfamiliar, and AP2’s mandate chain is designed to prove exactly what you authorized: useful evidence in a dispute. But if you’re staring at a four-figure charge you didn’t personally click “buy” on, that’s a situation where professional advice is warranted; the law genuinely hasn’t caught up.

If you let an agent buy: an 8-step safety procedure

Treat agent shopping in 2026 like early online banking: useful, but only with training wheels. Follow this procedure, based on the controls the protocols and networks actually support:

1. Use a dedicated card. A separate card with a low limit, or a single-use virtual card number, contains the blast radius if the agent misfires.
2. Turn on instant transaction alerts so you see every charge the moment it happens, not at month-end.
3. Set hard spend caps in the agent’s own controls. If the platform offers spending limits or AP2-style intent constraints, use them: a chat prompt saying “don’t spend more than $200” is not a control.
4. Require approval above a small threshold. Avoid standing auto-buy instructions; surveys cited by CNBC (Accenture data) show 82% of people want to approve every AI action, and that instinct is correct for now.
5. Never hand over bank logins or card PINs. Prefer protocol-based checkout (Google Pay, agentic tokens, Shared Payment Tokens) where the agent never sees raw credentials.
6. Save the brief. Screenshot the exact instructions you gave the agent before it starts. If a dispute comes, that record is your evidence of what was authorized.
7. If it goes wrong, dispute in order: merchant first (they’re the merchant of record and control refunds), then your card issuer, framing an out-of-bounds purchase as a transaction you did not authorize.
8. Revoke access when the task is done, and audit connected apps and agent permissions monthly. The banks Axios interviewed found agents lingering in accounts after users forgot about them: that’s the failure mode to avoid.

What to do next

If you’re a US consumer: try Universal Cart for holiday shopping (it’s the most complete shipped experience) and let ChatGPT or Gemini do research while you keep the payment click. If you run a shop: decide deliberately whether to allow agents, because right now most sites block them by accident, and Stripe merchants can adopt ACP with minimal integration work (Stripe). If you’re building an agent: assume you’ll be blocked, design for Trusted Agent Protocol identity and AP2-style mandates, and don’t scrape your way to checkout.

FAQ

Can AI agents buy products for you right now?

Yes, in a few US-first surfaces. Google’s Universal Cart, live since October 15, 2026, lets shoppers collect items from multiple retailers in Search’s AI Mode and the Gemini app and pay with Google Pay. ChatGPT routes you to merchant sites and apps to finish checkout. Amazon runs its own Buy for Me agent. No major retailer yet lets an unverified third-party agent roam and buy on its site.

Can AI agents book flights?

Mostly no, as of November 2026. Delta has no third-party agent integration and blocks agents from its booking flow, per The Verge, and travel apps inside ChatGPT from Expedia and Booking.com handle search and comparison but hand payment off to those companies’ own sites. Airlines fear seat-spinning bots and losing the direct customer relationship. Agents can still find and compare fares; a human usually completes the purchase.

How do AI agent payments work?

Two mechanisms dominate. Networks tokenize: Mastercard’s Agentic Tokens bind a credential to a registered agent with spending rules, and Visa replaces card numbers with tokens via payment passkeys. Protocol flows add mandates: Google’s AP2 uses cryptographically signed Intent and Cart Mandates that prove what the user authorized, creating an audit trail from instruction to payment.

What is the Agent Payments Protocol (AP2)?

AP2 is an open protocol Google announced in September 2025 with more than 60 partners including American Express, Mastercard, PayPal and Adyen. It extends the Agent2Agent protocol and MCP, and represents every purchase as signed verifiable credentials. Version 0.2 has been donated to the FIDO Alliance, where standardization continues. It is a specification with reference implementations, not a consumer product.

Is ChatGPT Instant Checkout still available?

Not in its original form. OpenAI launched Instant Checkout on September 29, 2025 with US Etsy sellers and planned Shopify support, but scaled it back in March 2026, with The Information reporting only about a dozen merchants had fully adopted it. Shopping in ChatGPT now leans on shopping research, retailer apps and links that send you to the merchant to complete payment.

What is Mastercard Agent Pay?

Agent Pay, announced April 29, 2025, is Mastercard’s framework for payments initiated by registered, verified AI agents, built on Agentic Tokens that carry spending rules and issuer visibility. Microsoft was the first AI platform partner. In June 2026 Mastercard added Agent Pay for Machines for machine-to-machine payments, with early access across 30-plus partners spanning cards, bank accounts and stablecoins.

Who is liable if an AI agent buys the wrong thing?

No comprehensive law assigns it yet. The merchant of record keeps fulfillment and refund duties, disputed agent purchases generally run through ordinary card chargeback rules, and US Regulation E’s definition of “authorized” is unsettled for agent-initiated transfers. US banks published positions in October 2026 pushing liability away from themselves. Treat a large disputed purchase as a case for professional advice.

What are the main limitations of agentic commerce?

Bot walls and CAPTCHAs stop agents mid-task on many major sites; Delta, Amazon, JPMorgan Chase and Charles Schwab actively restrict them; a federal judge barred Perplexity’s Comet from shopping on Amazon in March 2026; and most agent shopping is US-only. Spending controls, credential exposure and unresolved liability round out the risks.

How do I let an AI agent shop for me safely?

Use a dedicated low-limit or virtual card, enable instant transaction alerts, set hard spend caps, require approval above a small threshold, and never share bank logins or card PINs. Save the task instructions you gave the agent, dispute problems with the merchant first, and revoke the agent’s access when the task is done.

Sources

• Announcing Agent Payments Protocol (AP2): Google Cloud
• AP2 Protocol specification site
• Buy it in ChatGPT: OpenAI
• Stripe and OpenAI’s Instant Checkout announcement: Stripe Newsroom
• New tools for retailers in an agentic era (UCP): Google blog
• Universal Cart launches in the U.S.: Google blog
• Google Universal Commerce Protocol (UCP) developer guide
• Mastercard unveils Agent Pay: Mastercard press release, April 29, 2025
• Mastercard launches Agent Pay for Machines. Mastercard press release, June 2026
• Visa Intelligent Commerce: Visa
• Visa brings enhanced trust capabilities to agentic commerce: Visa press release, October 21, 2026
• Unvetted AI agents are accessing U.S. bank accounts: Axios, October 22, 2026
• JPMorgan, Amazon and the fight over AI agents: CNBC, November 1, 2026
• Websites are closing their doors to AI agents. The Verge, October 17, 2026
• Judge blocks Perplexity’s AI bot from shopping on Amazon. GeekWire, March 2026
• Agentic commerce set to generate $1.5 trillion globally by 2030: Juniper Research, April 2026
• ChatGPT brings apps into chat, starting with Expedia. PhocusWire, October 2025
• OpenAI debuts ChatGPT Work agent. MacRumors, July 9, 2026
• OpenAI scales back shopping plans for ChatGPT: The Information, March 2026
• AI agent chargeback liability: Chargeflow
• AI agent payment liability. Backbase