Can an AI agent make unauthorized purchases for you?

What did Amex just announce about AI agent purchases?

On October 13, 2026, American Express announced its Intent Intelligence Framework, a system meant to make sure an AI agent only buys what its user actually authorized. Before the agent checks out, the framework records what you asked for, such as the merchant, the budget and your product preferences, and has you authenticate and sign off on it. Your signed-off intent then gets an ID and a proof-of-intent token. The agent uses those to get a secure payment credential, so it never sees your real card number. If the purchase doesn't match what you approved, the transaction can be stopped. Amex wants this to become an industry standard. It builds on a developer toolkit for agent shopping that the company launched in April.

Amex's own example is pretty ordinary. You ask an agent for white sneakers in a size 9 from one brand, and the agent tries to buy a different brand's shoes. Under the framework, Amex can spot the mismatch and block the charge before it reaches your statement. The recorded intent also leaves a paper trail if there's a dispute later. Amex says agent shopping hasn't caused a rise in disputes yet. It wants to get ahead of the problem, and it pointed to survey data showing that most US consumers are likely to use AI agents for price research and product recommendations. The framework is still being rolled out to partners, so don't expect to see it at every checkout tomorrow.

Why should a payments story matter if you've never let a bot near your credit card? Because Amex is effectively defining what “authorized” means for an AI agent: you said what you wanted, you confirmed it, and the agent stayed inside those lines. You face the same question every time you hand a task to an AI, whether it's booking a table, paying a supplier or messaging a client for you. Spending money is just the version with the most at stake. Our take: the framework is a good seatbelt, but it was designed for online checkouts. Most small-business admin is messier than that, so you'll need your own rules. You can write them today, in plain words.

Can AI agents buy things without your permission?

Yes. Some AI agents can buy things without asking first if you've given them your payment details and permission to check out. That's the whole selling point of agent shopping: tell it what you want and it handles the rest. The catch is that “what you want” is vaguer than it sounds. “Order more printer paper” could mean one ream or ten boxes, the cheap brand or the one you always buy. A human assistant would ask. An agent built for convenience might just pick one. Even Amex expects agents to act more on their own for routine reorders like paper towels. That's fine for basics. It's risky for anything involving real money or real consequences.

Unauthorized purchases rarely look like theft. They look like small misunderstandings. The agent picks the wrong size or the wrong supplier, or chooses express shipping you'd never pay for. It signs you up for a subscription that renews once the free trial ends. It reorders something you meant to buy once, or confirms a booking you only wanted a quote for. None of this is fraud in the usual sense, because the agent was allowed to use your card. That's exactly why these mistakes are so hard to dispute. You authorized the agent, just not that purchase. Agent permission settings exist to close the gap between “allowed to act” and “allowed to do this particular thing.”

Money isn't the only thing an agent can spend on your behalf. It can spend your reputation too. An agent that emails a client in the wrong tone, accepts a delivery date you can't meet or tells a supplier “go ahead” has committed you just as firmly as a card charge would. And you can't file a chargeback on an awkward message. So when you think about AI agent spending limits, think wider. Watch three things: money leaving your account, promises made in your name, and messages that can't be unsent. Limit what the agent can pay for, and also what it can promise, confirm or agree to. The safest agents treat anything that commits you as a draft until you say yes.

What should “authorized” mean when you delegate to an AI agent?

Authorized should mean three things: the agent knew exactly what you wanted, you approved the specific action before it happened, and it told you afterwards what it did. Boiled down, that's Amex's framework: intent, sign-off and a record. It works for any task, not just purchases. Leave out any one of the three and you've handed the agent a blank cheque. With clear intent but no sign-off, the agent guesses whenever something unexpected comes up. With sign-off but no record, you're left wondering what went out and to whom. With a record but vague intent, you get a neat log of the wrong thing. You need all three. Fortunately, one well-written instruction covers them.

Rule one: make it ask before acting. Build the pause into your instruction so the agent can't skip it. Plain words work fine: “Message the supplier for a quote, but don't confirm anything until I reply.” Or “Find three plumbers who can come Thursday and show me the options. Don't book.” Or “Draft the reply to Maya about the delay and show it to me first.” Each of these splits the job into the part you're happy to hand over (finding, asking, drafting) and the part you keep (committing). It costs you one extra message. That's cheap insurance against an agent that's a bit too eager to help. It also leaves the agent no room to guess when the supplier asks a follow-up question.

Rule two: make it report back. “Tell me what each person said” or “Send me a summary when you're done” turns an invisible process into something you can check in ten seconds. Rule three: make payments yourself. Let the agent find the invoice, check the total and remind you when it's due, but press the pay button yourself. This is where we disagree with the people who want agents to do everything. Saving thirty seconds on a payment isn't worth the afternoon you'll spend undoing a wrong one. If you want an agent's help with cash flow, have it chase the money you're owed, not pay the money you owe. We explain where to draw that line with invoices in a separate guide.

How do you set AI agent permissions and spending limits that actually hold?

The limits that hold are the ones you write into each instruction, not ones you set on a settings page months ago and forgot about. An agent can't keep to a limit it never saw. So put the limit in every request: “Book a table for four at 8. Anything under 60 a head is fine, otherwise check with me.” Specific numbers beat vague trust. Named people beat “the team.” A deadline beats “soon.” The same goes for chasing people. “Ask the client for the signed contract by Friday and tell me what they say” is far safer than “sort out the contract.” For more ways to word these requests, see our guide to chasing clients for documents and payments on autopilot.

For anything that touches a card, use the controls your bank already offers. Many cards let you create virtual card numbers, set spending caps or get an alert on every charge. Give any agent you let near a checkout its own card with a low limit, so the worst case is capped by design rather than by hope. Turn on transaction alerts and check your recurring charges once a month. None of this is exciting, but it follows the same principle as Amex's token approach. The agent never holds the keys to your whole account, only a limited credential for one job that you can cancel at any time. If something goes wrong, you lose a small, known amount instead of finding out at the end of the month.

Start small and give the agent more freedom as it earns your trust. Hand a new agent low-stakes jobs first, like looking up opening hours, chasing a reply or summarizing a contract before you sign it, and watch how it behaves. Does it ask when it's unsure? Does it report back accurately? Does it stay within the limits you set? Only then move on to tasks that commit you to something. And keep an off switch within easy reach: a good agent lets you see what it's working on and cancel it with one message. If you can't easily answer “what is my agent doing right now?”, it has more freedom than it should.

How does Agent Sonic handle tasks that act on your behalf?

Agent Sonic follows the ask-first, report-back pattern, and it doesn't spend your money at all. It's a contact in WhatsApp that you message like anyone else. Its outreach tasks, available on the Pro plan, let it message people for you and bring back their answers. Outreach is in Beta and may be paused from time to time. You tell Sonic who to contact and what to find out: “Ask Dana when the invoice will be ready and let me know.” Before anything goes out, Sonic shows you the exact first message for each person. Reply “yes” to send it, “no” to drop it, or ask for changes in plain words, like “more formal” or “shorter, no emoji.” Your notes apply to the whole conversation, and the first message goes out exactly as you approved it.

Sonic never pretends to be you. It writes from its own WhatsApp number and introduces itself as your assistant, so nobody mistakes its question for a promise from you. It asks, follows up once at most if the answer is vague, and stops when it has the answer, when the person says no, or when they ask to be left alone. There are hard limits too. You can run one outreach task at a time, with up to three people a day. First messages only go out between 08:00 and 21:00 in the recipient's time zone, and only in one-to-one chats. Anyone who says “stop” gets a short apology and is never messaged through Sonic again. Requests to pressure, deceive or spam people are refused.

When each conversation ends, Sonic sends you the result (the answer, a refusal, or a note that there's been no reply after 24 hours) along with a short summary. You can ask any time, “Did the plumber answer yet?”, or send /tasks to see what's running, and /task cancel stops a task right away. That's how authorized should feel: you set the goal, you approve the words, and you get the record. Payments stay with you. Forward an invoice and Sonic can flag duplicates and check the math before you pay, but you make the payment. Our step-by-step outreach walkthrough covers your first run, and you can get Sonic's number and onboarding here.

Frequently asked questions