Agents at checkout: loss attribution for frontier labs' payment wallets

CSA published a research note analyzing ChatGPT Wallet, which OpenAI launched on November 13, 2026 together with American Express, Mastercard and Visa. The wallet lets the dots agent complete purchases on merchant websites without touching card numbers; each purchase requires biometric or device security confirmation and uses a payment token issued by the card network for that checkout. CSA's assessment is that neither OpenAI's announcement nor merchant documentation states who bears the cost of erroneous agent purchases, and that per-purchase biometric confirmation constitutes strong evidence of cardholder authorization, so the cost of a human-approved erroneous purchase most likely falls on consumers and merchant return processes rather than on issuer fraud disputes; American Express has committed to covering erroneous purchases by its registered agents, but the terms have not been published, and it is not stated whether the ChatGPT agent counts as a registered agent.