The Agentic Commerce Report

Amazon activated automated purchase capabilities within its Rufus shopping assistant this week ¹, allowing users to complete product orders through conversational interaction without leaving the Amazon interface. Perplexity launched a direct-buy feature integrated with PayPal ², the second AI search platform to connect purchase intent to payment processing in the same week.

Visa published its PERC (Payment Ecosystem Risk and Controls) fall 2025 report ³, categorising agent-specific threats across three domains: credential hijacking in multi-agent delegation chains, manipulation of agent decision logic through adversarial prompt injection, and replay attacks using captured agent authorisation tokens.

Amazon Rufus joins Walmart’s ChatGPT checkout ⁴ and Stripe’s ACP Instant Checkout ⁵ as the third major retail platform to deploy agent-initiated purchase capability. Perplexity’s PayPal integration mirrors the Stripe-ChatGPT model: an AI interface paired with an existing payment processor, neither of which owns the other’s infrastructure.

The Visa PERC report is the first security-focused publication from a payment network addressing agent-specific threats. All three lanes active this week — Pilots, AEO, and Security — recorded first or second events in the same week; Security recorded its first event in the tracking period.