Walmart lets AI agents shop, inside a limit the customer sets

Walmart opened its shop to outside AI agents on Wednesday 21 October through Walmart Agent Gateway, a model context protocol server that lets approved agents search Walmart and Sam’s Club inventory and buy on a customer’s behalf [1] [2]. John Furner, Walmart’s chief executive, announced it at the Masters of Scale Summit in San Francisco [1]. Reuters named OpenAI’s ChatGPT, Google’s Gemini and Meta’s Muse among the assistants that can connect [2].

The controls arrive next month with Agent Profiles [1] [2]. Each agent a customer uses gets its own profile inside the Walmart account, created the first time it shops through the gateway [1]. The customer either approves every transaction or sets a spending limit, sees the agent’s orders apart from their own, and can revoke or delete the profile at any time [1] [2]. Walmart compares it to adding an authorised user to a credit card, whose purchases are identified and can be capped [1]. Agents cannot see payment card data and may take only the information a task needs [1] [2]. An agent that breaks Walmart’s new agent terms is blocked, and the same terms keep the returns process in force when an agent does not act as intended [1]. No Walmart+ membership is needed [1] [2].

The four banks in the last edition refused agents that log in with a customer’s password. On the desk’s reading, such an agent cannot be told apart from the customer, and Walmart has built the separation that was missing: the agent has its own identity in the account, and the cap is held by Walmart, outside the agent, which is where the desk’s answer on spending limits says a limit has to sit. Amazon has gone the other way and blocks outside shopping agents [1], on the terms set out in the desk’s answer on whether AI agents can shop on Amazon. David Bellinger, an analyst at Mizuho, wrote in a note that “the momentum and buy-in from top management teams seems to be making this into a real thing” [2].

Visa, BILL and Billtrust let an agent pay invoices through supplier portals

Visa, BILL and Billtrust said on 20 October that a live pilot lets an AI agent pay approved supplier invoices end to end through supplier portals [3]. BILL’s payment agent is registered with Visa’s Trusted Agent Protocol and Agentic Directory and pays with tokenised card credentials, under controls tied to the buyer’s approved payment instruction [3]. On the supplier side, Billtrust uses the same protocol to recognise and authenticate the agent, which Visa says can stand in for the protection CAPTCHA and other bot blocking used to provide, with no separate agent login [3]. The release says the agent pays only invoices the buyer has already approved, and that nobody shares a supplier-portal login [3].

Mark Nelsen, who runs product for Visa’s commercial and money movement business, said “businesses should not have to choose between automation and control when making payments” [3]. Visa gives no transaction count, only that the pilot is processing end-to-end payments with participating BILL buyers and Billtrust suppliers [3]. The step it automates is the one where a clerk keys a card number into someone else’s portal, and the agent that replaces the clerk carries its own credential instead of the clerk’s password.

The OCC finalises its GENIUS Act rule

The Office of the Comptroller of the Currency issued its final rule under the GENIUS Act on 21 October [4]. It covers permitted and foreign payment stablecoin issuers under the OCC’s jurisdiction and certain custody work at OCC-supervised firms, with standards for reserve assets, redemption, risk management, audits and reporting, custody and a capital and operational backstop [4] [5] [6]. Bank Secrecy Act, anti-money laundering and sanctions rules are left to a separate rulemaking with the Treasury [4] [5]. The rule and the Act take effect on 18 January 2027 [4] [5].

The OCC proposed the rule on 25 February and received hundreds of comments [4] [5]. In August, Jonathan Gould, the Comptroller, said the agency wanted a final rule out by November so it could start processing applications in the new year [6]. It finished in October, after regulators had already missed the law’s July deadline [6]. The OCC says it will announce separately when it begins accepting applications and waiver requests from would-be issuers [4]. The law takes effect 87 days after this edition.