ChatGPT Wallet security: how AI agent payments work

OpenAI announced ChatGPT Wallet on November 13, 2026. It lets ChatGPT agents (the "dots") pay for things on your behalf without ever seeing your real card number. Every purchase needs your approval with a biometric check like Face ID, and the merchant gets a one-off network token instead of your card.

I work on security at erxes, so my first question with any agent payment feature is simple: what can the agent do with my money when I'm not looking? For ChatGPT Wallet, the honest answer right now is "not much", and that's a good thing. Here is how it works, where the risk moves, and what merchants and builders should do about it.

How ChatGPT Wallet payments work

The flow from OpenAI's announcement and the help center article goes like this:

You add a card once, through a secure form. OpenAI is explicit that card numbers and bank verification codes go in that form, never in the chat.
Your dot shops: finds the sweater, books the hotel, fills the cart.
At checkout you get a purchase request showing merchant, items, total, selected card, and any shipping or recurring terms.
You approve with Face ID, Touch ID, or similar. If your current device can't do biometrics, you get a link or QR code to finish on a phone.
The network issues a payment token, and the dot uses that virtual card number in the merchant's normal checkout.

The partners are American Express, Mastercard, and Visa, and the help center also lists eligible Chase cards. You keep your card's rewards and dispute protections.

One detail I like: "ready to check out" only means your approval went through. It doesn't mean the merchant placed the order. OpenAI tells users to look for a merchant confirmation before retrying. That's the right call, because an agent that retries a payment on an ambiguous result is how you end up with two hotel bookings.

Why the token model matters for security

The biggest risk with agent payments is credential exposure. If an agent can read your card number, that number lives in context windows, logs, tool outputs, and anywhere a prompt injection can reach.

ChatGPT Wallet takes that off the table. The agent never holds the real PAN. What it gets is a token scoped to one approved transaction, and OpenAI's merchant guide says merchants must not reuse or save that credential for a separate purchase. Merchants that need to recognize a returning customer get a Payment Account Reference (PAR) to link the token to the underlying account.

The biometric check per purchase matters too. Each approval creates a record of exactly what the user authorized. When a dispute comes in, there's a clear line between "I approved this" and "the agent did this on its own". For a bank's risk team, that record is worth a lot.

An agent making a purchase should strengthen, not bypass, the trust built into payments.

— Sherri Haymond, Mastercard

Where the risk still lives

Tokens fix card theft. They don't fix bad decisions. A few things I would still watch:

Approval fatigue. Biometric prompts get approved on reflex. If the dot picked the wrong size, the wrong dates, or a sketchy merchant, Face ID won't save you. The review screen is the real control, and users will skim it.
Recurring charges. If you approve a subscription, the merchant can store the credential and charge again under the terms you agreed to. Cancelling goes through the merchant, not ChatGPT.
Prompt injection on product pages. The dot reads websites. A page that tricks it into adding items or picking a different seller is still possible. The approval step catches the outcome, but only if you read it.
The future delegation mode. OpenAI says users will later be able to pre-approve purchases with spending limits, categories, or time windows. That's the part I care about most. Once a human isn't in every loop, the limits and audit trail have to carry the full weight.

What merchants need to change

OpenAI says ChatGPT Wallet works with existing checkout pages and needs no Wallet-specific integration. In practice, the hard part is that your own defenses will block it.

Risk systems are tuned to catch bots using IP addresses and browser fingerprints. ChatGPT runs a cloud browser, so a legitimate purchase looks a lot like a bot. OpenAI's fix has two parts:

Signed requests. Configure your CDN or firewall to recognize ChatGPT agents through Web Bot Auth, which signs requests with HTTP message signatures instead of relying on IP lists.
Forwarded user signals. OpenAI is rolling out a Forwarded header carrying signals about the real user, such as ip-country, a masked ip-prefix, asn, locale, tz, and user-agent. If you run your own fraud rules, start logging it. If you use a provider, ask whether they ingest it.

Forwarded: asn=64496;ip-prefix="192.0.2.0/24";user-agent="Example/130"

A note from the security side: treat the Forwarded header as a signal, not as proof. Only trust it on requests that also pass Web Bot Auth verification, or anyone can send ip-country=US from anywhere.

OpenAI also says it's working with fraud vendors (Forter, Riskified, Sardine, Signifyd) and payment providers (Adyen, Checkout.com, Stripe) so their systems recognize agent purchases. If you're on one of those, a lot of this may arrive as a config change.

This connects to something I wrote about recently: Cloudflare's Kitesurf browser for AI agents. Agents are becoming real web clients, and sites need a way to tell a verified agent from a scraper. Payments are the point where that stops being optional.

What it means for builders of agent platforms

If you're building agents that act for users, as I've done with the erxes AI agents plugin, the pattern here is worth copying even outside payments:

Keep secrets out of the model's reach. Give the agent a scoped, single-use capability, not the raw credential.
Put a human approval step on irreversible actions, and make the approval screen show the details that matter.
Log each approval as its own record, separate from the agent's actions.
Don't let the agent assume success on an unclear result. Check the source of truth first.

Availability

ChatGPT Wallet is rolling out gradually to ChatGPT Pro subscribers in the US who are 18 or older, with eligible US-issued cards and a US billing address. It only works in conversations with a dot, not in regular Chat, Work, or standalone Codex. OpenAI says ChatGPT has 1.2 billion weekly users, so wider rollout would make agent checkout a normal traffic pattern fast.

FAQ

Does the merchant get my real card number with ChatGPT Wallet?

No. The merchant receives a network token with its own card number, security code, and expiry. It can use the Payment Account Reference to link that token to your account.

Can my ChatGPT agent buy things without asking me?

Not today. Every purchase needs your review and a biometric approval. OpenAI has said pre-approved purchases with spending limits are a future plan.

Do merchants need to integrate anything to accept ChatGPT Wallet?

No integration is required, since it uses existing checkout forms. But merchants should make sure their firewall and fraud tools don't block ChatGPT agents, using Web Bot Auth and the new Forwarded header signals.

Who can use ChatGPT Wallet right now?

US ChatGPT Pro users aged 18 and up, with eligible American Express, Chase, Mastercard, or Visa cards, inside dots.

What to watch next

The current version is the safe one: a human approves every payment. The real test comes with delegated purchases and spending limits. When that ships, I'll be reading the fine print on how limits are enforced, who carries liability when an agent stays inside the limits but buys the wrong thing, and how much of the audit trail merchants and banks can see.

Sources

Cover image: OpenAI