Last week Visa ran 22 AI shopping agents through 15 real shopping tasks. 43% of the runs failed. Here's the part almost nobody is talking about: in more than half of the failed runs, the agent bought something anyway.
A person who can't find the right TV walks out of the store. An agent picks the wrong one and pays.
And Visa only tested the choosing part. Checkout and payment weren't even in scope yet.
Why this happens (we see it daily)
We run a pre-spend firewall between shopping agents and checkout on live Shopify stores - every agent transaction gets screened before money moves. After 90 days of real traffic, the most common block is not fraud, not budget abuse, and not prompt injection.
It's purchase-with-unresolved-ambiguity: the agent never resolved which product it was actually buying, and converted its uncertainty into an order.
Three patterns cause almost all of it:
Confidence is never checked at the buy boundary. The agent ranks products internally, gets 0.42 vs 0.38 for two SKUs, and proceeds. A human at 0.42 confidence walks out. The agent pays.
Product data is thin, so the agent guesses. Stores feed agents a knowledge base built from marketing copy. Missing specs, stale prices, no stock truth. The agent fills gaps with plausible guesses and the guess becomes a purchase.
Stopping is never a requirement. Completion is tested ("did it buy something?"), termination is not ("did it buy the right thing, or correctly decline?"). Visa's study tested completion. That's why the failures look like successes until the return comes in.
What actually stops it
The fix lives at the checkout boundary, not in the prompt. Prompting the agent to "be careful" changes nothing - we measured.
The buy endpoint itself should demand a resolution proof before accepting payment:
- a matched SKU (not a description that resembles one)
- a confidence threshold the agent must state and meet
- a cart total within tolerance of the store's own price feed
If any check fails, the endpoint answers with a payment-required style response. Agents handle "payment required" as normal protocol state - they stop and re-plan instead of forcing through or throwing errors. This one design choice does more than any guardrail prompt.
The free side effect stores love
Every blocked intent gets logged with its reason. After a few weeks that log becomes a list of your actual product-data gaps - the specs agents couldn't find, the prices that were stale, the fields that made matching ambiguous. Stores use it as a work queue for fixing their catalog. The firewall pays for itself as a data-quality audit tool.
Test for termination, not just completion
If you're building or deploying shopping agents, add one acceptance test: does the agent correctly NOT buy when the match is bad? Seed an ambiguous catalog, run the agent, count wrong purchases. If your agent passes "did it complete" but fails "did it correctly refuse", Visa's 43% is your future.
We screen agent transactions at sipi.bot/tripwire - 12 checks, runs on your store in about 4 minutes, one-time $7, and if it finds nothing real you don't pay. If you're shipping agentic commerce this holiday season, it's cheaper than one wrong-TV order.
